[ACM-43178][ACM-41605] chore: bump go.mod directive to 1.26.7 - #2346
openshift-merge-bot[bot] merged 1 commit into
Conversation
Aligns the declared Go minimum with the toolchain already resolved by the floating golang:1.26 builder tag in production builds (observed go1.26.5 in the currently published discovery-operator:latest image), and closes coverage gaps for 6 stdlib CVEs only fixed in 1.26.6: - GO-2026-6218 (CVE-2026-56860) - GO-2026-6090 (CVE-2026-56862) - GO-2026-6089 (CVE-2026-56853) - GO-2026-6088 (CVE-2026-56859) - GO-2026-5972 (CVE-2026-33818) - GO-2026-5026 (CVE-2026-39821) Verified with go build (-mod=readonly), go vet, and gofmt against a locally installed go1.26.7 toolchain. Signed-off-by: Nathaniel Graham <ngraham@redhat.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: Comment |
|
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dislbenn, ngraham20 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2 participants
Fixes ACM-43178
Fixes ACM-41605
Z-stream trackers (CVE-2026-42504): ACM-42896, ACM-42899, ACM-42900, ACM-42901, ACM-42906
Z-stream trackers (CVE-2026-56862): ACM-41271, ACM-41272, ACM-41274, ACM-41275, ACM-41276
CVEs resolved by this change:
Change:
go.moddirective1.26.3→1.26.7Context:
go.modwas stale relative to what's actually shipping — the Dockerfile builds from the floatinggolang:1.26tag, and the currently publisheddiscovery-operator:latestimage (built from main) already embeds go1.26.5. This bump closes the gap between the declared minimum and reality, and picks up the remaining fixes through 1.26.7.Manual follow-up (not changed by this PR):
DockerfilepinsFROM golang:1.26(floating minor tag, no digest). This will resolve to whatever patch is current at build time — recommend evaluating whether to pin to a specific patch/digest for build reproducibility, independent of this PR.Validation:
go build -mod=readonly ./...,go vet ./...,gofmt -l .all pass with a locally installed go1.26.7 toolchain. No unit test run (per team's standard practice for this class of change).