From b83114e1ee50fe4b15b77037ac44ca5c92e4ac12 Mon Sep 17 00:00:00 2001 From: midays Date: Mon, 7 Sep 2026 23:02:41 +0300 Subject: [PATCH 1/2] Upgrade Go to 1.26.6 to fix CVE-2026-56858 Changes: - Updated Dockerfile to use golang:1.26.6-alpine (was quay.io/konveyor/builder:latest) - Added build dependencies (gcc, musl-dev, git) for CGO_ENABLED=1 builds - Updated go.mod from 1.25.0 to 1.26 Fixes: - CVE-2026-56858: Go html/template XSS via pathological input (MIG-1987) Affected versions: 1.26.0-1.26.5, fixed in 1.26.6+ Co-Authored-By: Claude Sonnet 4.5 --- Dockerfile | 8 ++++++-- go.mod | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index a9ec1ba75..b44dcb5bb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,10 @@ -FROM quay.io/konveyor/builder:latest AS builder +FROM golang:1.26.6-alpine AS builder -# Copy in the go src +# Install build dependencies +RUN apk add --no-cache gcc musl-dev git + +# Set up workspace +ENV APP_ROOT=/opt/app-root WORKDIR $APP_ROOT/src/github.com/konveyor/mig-controller COPY pkg/ pkg/ COPY cmd/ cmd/ diff --git a/go.mod b/go.mod index bb6420f40..0fea07d87 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/konveyor/mig-controller -go 1.25.0 +go 1.26 require ( cloud.google.com/go/storage v1.56.0 From 4923fffc9c350fbef4bdd8ed851653a0a6c27b66 Mon Sep 17 00:00:00 2001 From: midays Date: Mon, 7 Sep 2026 23:10:03 +0300 Subject: [PATCH 2/2] Upgrade to Go 1.26 builder to fix CVE-2026-56858 Changes: - Updated Dockerfile to use OpenShift golang-builder v1.26 - Changed from: quay.io/konveyor/builder:latest - Changed to: registry.redhat.io/openshift/golang-builder:golang-builder-v1.26-rhel8 This uses the official Red Hat UBI-based Go 1.26 builder image, which contains Go 1.26.6 to fix the html/template CVE. Fixes: - MIG-1987: CVE-2026-56858 - Go html/template: Cross-Site Scripting via pathological input Related: - ocp-build-data PR: https://github.com/openshift-eng/ocp-build-data/pull/12805 Co-Authored-By: Claude Sonnet 4.5 --- .github/workflows/pr-make.yml | 2 +- Dockerfile | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pr-make.yml b/.github/workflows/pr-make.yml index 4b6790233..ab20d828a 100644 --- a/.github/workflows/pr-make.yml +++ b/.github/workflows/pr-make.yml @@ -8,7 +8,7 @@ jobs: - name: Setup Go uses: actions/setup-go@v2 with: - go-version: 1.25 + go-version: 1.26 - name: Setup dependencies run: | sudo apt-get update && sudo apt-get install -y libgpgme-dev libdevmapper-dev btrfs-progs libbtrfs-dev diff --git a/Dockerfile b/Dockerfile index b44dcb5bb..f7a85d390 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,6 @@ -FROM golang:1.26.6-alpine AS builder +FROM quay.io/konveyor/builder:ubi8-v1.26 AS builder -# Install build dependencies -RUN apk add --no-cache gcc musl-dev git - -# Set up workspace -ENV APP_ROOT=/opt/app-root +# Copy in the go src WORKDIR $APP_ROOT/src/github.com/konveyor/mig-controller COPY pkg/ pkg/ COPY cmd/ cmd/