Skip to content

chore: bump Go to 1.26.6 to patch stdlib CVEs - #2316

Closed
dislbenn wants to merge 1 commit into
stolostron:mainfrom
dislbenn:chore/go-1.26.6-cve-patch
Closed

chore: bump Go to 1.26.6 to patch stdlib CVEs#2316
dislbenn wants to merge 1 commit into
stolostron:mainfrom
dislbenn:chore/go-1.26.6-cve-patch

Conversation

@dislbenn

@dislbenn dislbenn commented Aug 18, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Description

Bumps the Go toolchain from 1.26.3 to 1.26.6 to patch six stdlib CVEs affecting discovery-rhel9.

Related Issue

Changes Made

  • go.mod: go 1.26.3 → go 1.26.6
  • .github/workflows/kind.yaml: CI Go version matrix 1.26.3 → 1.26.6
  • Dockerfile builder image intentionally left as the floating golang:1.26 tag, which will pick up the patched 1.26.6 release automatically on next build.

Screenshots (if applicable)

N/A

Checklist

  • I have tested the changes locally and they are functioning as expected.
  • I have updated the documentation (if necessary) to reflect the changes.
  • I have added/updated relevant unit tests (if applicable). — N/A, no test changes required
  • I have ensured that my code follows the project's coding standards.
  • I have checked for any potential security issues and addressed them. — This PR fixes security issues.
  • I have added necessary comments to the code, especially in complex or unclear sections. — N/A
  • I have rebased my branch on top of the latest main/master branch.

Additional Notes

Verified locally with Go 1.26.6:

  • go mod tidy — no go.sum changes required
  • make build — succeeds
  • make test — all unit tests pass

Reviewers

/cc

Definition of Done

  • Code is reviewed.
  • Code is tested.
  • Documentation is updated.
  • All checks and tests pass.
  • Approved by at least one reviewer.
  • Merged into the main/master branch.

Summary by CodeRabbit

  • Chores
    • Updated the project’s supported Go version to 1.26.6.
    • Updated automated test workflows to use Go 1.26.6.

@openshift-ci

openshift-ci Bot commented Aug 18, 2026

Copy link
Copy Markdown

@dislbenn: GitHub didn't allow me to request PR reviews from the following users: dislbenn.

Note that only stolostron members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Description

Bumps the Go toolchain from 1.26.3 to 1.26.6 to patch six stdlib CVEs affecting discovery-rhel9.

Related Issue

  • ACM-41609 - CVE-2026-56853 (net/http HTTP/2 DoS)
  • ACM-41608 - CVE-2026-56860 (net/url DoS)
  • ACM-41607 - CVE-2026-56859 (XML recursion DoS)
  • ACM-41606 - CVE-2026-56858 (html/template XSS)
  • ACM-41605 - CVE-2026-56862 (crypto/tls DoS)
  • ACM-41604 - CVE-2026-33818 (encoding/asn1 recursion DoS)

Changes Made

  • go.mod: go 1.26.3 → go 1.26.6
  • .github/workflows/kind.yaml: CI Go version matrix 1.26.3 → 1.26.6
  • Dockerfile builder image intentionally left as the floating golang:1.26 tag, which will pick up the patched 1.26.6 release automatically on next build.

Screenshots (if applicable)

N/A

Checklist

  • I have tested the changes locally and they are functioning as expected.
  • I have updated the documentation (if necessary) to reflect the changes.
  • I have added/updated relevant unit tests (if applicable). — N/A, no test changes required
  • I have ensured that my code follows the project's coding standards.
  • I have checked for any potential security issues and addressed them. — This PR fixes security issues.
  • I have added necessary comments to the code, especially in complex or unclear sections. — N/A
  • I have rebased my branch on top of the latest main/master branch.

Additional Notes

Verified locally with Go 1.26.6:

  • go mod tidy — no go.sum changes required
  • make build — succeeds
  • make test — all unit tests pass

Reviewers

/cc

Definition of Done

  • Code is reviewed.
  • Code is tested.
  • Documentation is updated.
  • All checks and tests pass.
  • Approved by at least one reviewer.
  • Merged into the main/master branch.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented Aug 18, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dislbenn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved PR approval has been given label Aug 18, 2026
@coderabbitai

coderabbitai Bot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a0d1dd07-2f0d-4631-84fc-698dab7c25ba

📥 Commits

Reviewing files that changed from the base of the PR and between adfb46a and b17ad82.

📒 Files selected for processing (2)
  • .github/workflows/kind.yaml
  • go.mod

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The module requirement and KinD workflow matrix now use Go 1.26.6 instead of 1.26.3.

Changes

Go version alignment

Layer / File(s) Summary
Update Go version references
.github/workflows/kind.yaml, go.mod		 The module requirement and KinD test matrix now use Go 1.26.6.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to b17ad

This PR updates the Go toolchain version and matching CI configuration to the patched release. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: ngraham20

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely states that Go is being upgraded to 1.26.6 to address standard-library CVEs.
Description check ✅ Passed The description covers the purpose, related issues, file changes, validation results, security impact, and checklist status.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dislbenn
chore: bump Go to 1.26.6 to patch stdlib CVEs
ae1967f 
Patches 6 Go stdlib vulnerabilities by bumping the toolchain
version from 1.26.3 to 1.26.6:

- CVE-2026-56853 (net/http HTTP/2 DoS) - ACM-41609
- CVE-2026-56860 (net/url DoS) - ACM-41608
- CVE-2026-56859 (XML recursion DoS) - ACM-41607
- CVE-2026-56858 (html/template XSS) - ACM-41606
- CVE-2026-56862 (crypto/tls DoS) - ACM-41605
- CVE-2026-33818 (encoding/asn1 recursion DoS) - ACM-41604

Dockerfile builder image is left as the floating 'golang:1.26'
tag, which will pick up the patched version automatically.

Signed-off-by: dislbenn <dbennett@redhat.com>
@dislbenn
dislbenn force-pushed the chore/go-1.26.6-cve-patch branch from b17ad82 to ae1967f Compare August 18, 2026 16:19
@sonarqubecloud

sonarqubecloud Bot commented Aug 18, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions

github-actions Bot commented Aug 24, 2026

Copy link
Copy Markdown

This pull request has been marked as stale due to inactivity for 5 days. It will be closed in 7 days if no further activity occurs.

@dislbenn

dislbenn commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

/retest

1 similar comment
@dislbenn

dislbenn commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@dislbenn

dislbenn commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown

This pull request has been marked as stale due to inactivity for 5 days. It will be closed in 7 days if no further activity occurs.

@dislbenn

dislbenn commented Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Closing this PR in favor of #2346

@dislbenn dislbenn closed this Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

approved PR approval has been given dco-signoff: yes no-pr-activity

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dislbenn