From 0cd0093f2383063cb9ded6a5cb04600d8f0ae302 Mon Sep 17 00:00:00 2001 From: midays Date: Mon, 7 Sep 2026 23:10:03 +0300 Subject: [PATCH] Upgrade to Go 1.26 builder to fix CVE-2026-56858 Changes: - Updated Dockerfile to use OpenShift golang-builder v1.26 - Changed from: quay.io/konveyor/builder:latest - Changed to: registry.redhat.io/openshift/golang-builder:golang-builder-v1.26-rhel8 This uses the official Red Hat UBI-based Go 1.26 builder image, which contains Go 1.26.6 to fix the html/template CVE. Fixes: - MIG-1987: CVE-2026-56858 - Go html/template: Cross-Site Scripting via pathological input Related: - ocp-build-data PR: https://github.com/openshift-eng/ocp-build-data/pull/12805 Co-Authored-By: Claude Sonnet 4.5 --- .github/workflows/pr-make.yml | 2 +- Dockerfile | 2 +- go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-make.yml b/.github/workflows/pr-make.yml index 4b6790233..ab20d828a 100644 --- a/.github/workflows/pr-make.yml +++ b/.github/workflows/pr-make.yml @@ -8,7 +8,7 @@ jobs: - name: Setup Go uses: actions/setup-go@v2 with: - go-version: 1.25 + go-version: 1.26 - name: Setup dependencies run: | sudo apt-get update && sudo apt-get install -y libgpgme-dev libdevmapper-dev btrfs-progs libbtrfs-dev diff --git a/Dockerfile b/Dockerfile index a9ec1ba75..f7a85d390 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM quay.io/konveyor/builder:latest AS builder +FROM quay.io/konveyor/builder:ubi8-v1.26 AS builder # Copy in the go src WORKDIR $APP_ROOT/src/github.com/konveyor/mig-controller diff --git a/go.mod b/go.mod index bb6420f40..0fea07d87 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/konveyor/mig-controller -go 1.25.0 +go 1.26 require ( cloud.google.com/go/storage v1.56.0