diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index bf493f848..f7224e816 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -37,7 +37,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" - name: Run live-provider canaries env: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb52355a7..9573c1146 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,7 +46,7 @@ jobs: run: make go-version-check - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: @@ -83,7 +83,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -118,7 +118,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -147,7 +147,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - run: go test -coverprofile=coverage.out -covermode=atomic ./cmd/... ./internal/... ./tools/... - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 @@ -211,7 +211,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Run API race shard if: matrix.scope == 'api' @@ -272,7 +272,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true # Coverage runs on main and development only. On a v* tag this job gates # the image and goreleaser, so it runs the same suites without coverage: @@ -353,7 +353,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Run API race shard if: matrix.scope == 'api' @@ -558,7 +558,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -680,7 +680,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Run ABS contract suite env: @@ -709,7 +709,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Wait for ArgoCD dev to sync env: diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 428d24312..c0b6b8c0f 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -65,7 +65,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Locate Go fuzz corpus cache diff --git a/.github/workflows/ping-drift.yml b/.github/workflows/ping-drift.yml index a00720581..fcac037be 100644 --- a/.github/workflows/ping-drift.yml +++ b/.github/workflows/ping-drift.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true # "the newest commit that would have produced an image" is git's diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index c044a3308..0ed2adbef 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -308,7 +308,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/Dockerfile b/Dockerfile index b60023755..4560580ef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ COPY internal/textutil/testdata/ /app/internal/textutil/testdata/ RUN npm run build # Stage 2: Build Go binary (native on BUILDPLATFORM, cross-compile to TARGETOS/TARGETARCH) -FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder +FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder WORKDIR /app COPY go.mod go.sum ./ RUN go mod download diff --git a/changelog.d/go-toolchain-1.26.9-cve.md b/changelog.d/go-toolchain-1.26.9-cve.md new file mode 100644 index 000000000..a3ef8e12c --- /dev/null +++ b/changelog.d/go-toolchain-1.26.9-cve.md @@ -0,0 +1,2 @@ +### Security +- **Bumped the Go toolchain to 1.26.9**, fixing [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617), an HTTP/2 server crash from an HPACK encoder race in `net/http`. Every build target (`go.mod`, the three Dockerfiles, every CI workflow) moves together, the same discipline #2956 established for the release binaries and the container image. diff --git a/cmd/discord-stats/Dockerfile b/cmd/discord-stats/Dockerfile index c14e4d606..78b68ab0f 100644 --- a/cmd/discord-stats/Dockerfile +++ b/cmd/discord-stats/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder +FROM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder WORKDIR /src COPY go.mod go.sum ./ RUN go mod download diff --git a/cmd/telemetry-server/Dockerfile b/cmd/telemetry-server/Dockerfile index 45810a138..a24d65c17 100644 --- a/cmd/telemetry-server/Dockerfile +++ b/cmd/telemetry-server/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder +FROM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder WORKDIR /src COPY go.mod go.sum ./ RUN go mod download diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 58cb1049f..69becebb4 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -33,7 +33,7 @@ to sync from until they are relinked. | Layer | Stack | Notes | |-------|-------|-------| | **HTTP router** | [chi](https://github.com/go-chi/chi) v5 | Sub-routers per resource, middleware-driven auth/CSRF/rate-limit. | -| **Backend language** | Go 1.26 (built with `golang:1.26.8-alpine`, the toolchain pinned in `go.mod`) | Standard library HTTP server, structured logging via `slog`. | +| **Backend language** | Go 1.26 (built with `golang:1.26.9-alpine`, the toolchain pinned in `go.mod`) | Standard library HTTP server, structured logging via `slog`. | | **Database** | SQLite, WAL mode | [`modernc.org/sqlite`](https://pkg.go.dev/modernc.org/sqlite) — pure Go, no CGO. Single `bindery.db` file. Connection pragmas (`foreign_keys`, `busy_timeout`, `synchronous`, `temp_store`, `cache_size`) are carried in the DSN so the driver reapplies them to every connection it opens; see [Database durability](DEPLOYMENT.md#database-durability). | | **Schema migrations** | Embedded SQL files in `internal/db/migrations/` | Linearly-numbered, additive-only, applied at startup. | | **Frontend** | React 19 + TypeScript + Tailwind CSS 4 | Built with [Vite](https://vite.dev), output baked into the binary via `go:embed`. | diff --git a/go.mod b/go.mod index 3f5ef63f5..fa691bf62 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/vavallee/bindery go 1.26.0 -toolchain go1.26.8 +toolchain go1.26.9 require ( github.com/coreos/go-oidc/v3 v3.21.0