From b1d486d2cf283f5be080998fd2c96bdda4c158ca Mon Sep 17 00:00:00 2001 From: gch ahcg Date: Sat, 10 Oct 2026 21:33:33 -0400 Subject: [PATCH] chore(deps): bump Go toolchain to 1.26.9 (GO-2026-6617) GO-2026-6617 (HTTP/2 server crash from an HPACK encoder race in net/http) lands at HIGH severity in both govulncheck's and Grype's vulnerability databases as of today, both freshly updated; it is fixed in go1.26.9. The repo's pinned go1.26.8 toolchain is affected, which fails the lint job's govulncheck step and the container image's Grype scan on every PR and on main's own next run, starting now. Bumps go.mod's toolchain directive, all three Dockerfiles' golang base image (tag and digest, verified against the real registry manifest and a full docker build), and every workflow's setup-go go-version, kept in lockstep per make go-version-check (#2956's discipline). docs/ARCHITECTURE.md mentions the pinned tag and is updated to match. Verified: make go-version-check passes, govulncheck ./... is clean, full Go test suite passes, golangci-lint v2.11.4 is clean, and a full docker build -f Dockerfile . succeeds end to end. Signed-off-by: gch ahcg --- .github/workflows/canary.yml | 2 +- .github/workflows/ci.yml | 20 ++++++++++---------- .github/workflows/fuzz.yml | 2 +- .github/workflows/ping-drift.yml | 2 +- .github/workflows/security.yml | 2 +- Dockerfile | 2 +- changelog.d/go-toolchain-1.26.9-cve.md | 2 ++ cmd/discord-stats/Dockerfile | 2 +- cmd/telemetry-server/Dockerfile | 2 +- docs/ARCHITECTURE.md | 2 +- go.mod | 2 +- 11 files changed, 21 insertions(+), 19 deletions(-) create mode 100644 changelog.d/go-toolchain-1.26.9-cve.md diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index bf493f848..f7224e816 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -37,7 +37,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" - name: Run live-provider canaries env: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb52355a7..9573c1146 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,7 +46,7 @@ jobs: run: make go-version-check - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: @@ -83,7 +83,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -118,7 +118,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -147,7 +147,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - run: go test -coverprofile=coverage.out -covermode=atomic ./cmd/... ./internal/... ./tools/... - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 @@ -211,7 +211,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Run API race shard if: matrix.scope == 'api' @@ -272,7 +272,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true # Coverage runs on main and development only. On a v* tag this job gates # the image and goreleaser, so it runs the same suites without coverage: @@ -353,7 +353,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Run API race shard if: matrix.scope == 'api' @@ -558,7 +558,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -680,7 +680,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Run ABS contract suite env: @@ -709,7 +709,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Wait for ArgoCD dev to sync env: diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 428d24312..c0b6b8c0f 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -65,7 +65,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - name: Locate Go fuzz corpus cache diff --git a/.github/workflows/ping-drift.yml b/.github/workflows/ping-drift.yml index a00720581..fcac037be 100644 --- a/.github/workflows/ping-drift.yml +++ b/.github/workflows/ping-drift.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true # "the newest commit that would have produced an image" is git's diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index c044a3308..0ed2adbef 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -308,7 +308,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.26.8" + go-version: "1.26.9" cache: true - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/Dockerfile b/Dockerfile index b60023755..4560580ef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ COPY internal/textutil/testdata/ /app/internal/textutil/testdata/ RUN npm run build # Stage 2: Build Go binary (native on BUILDPLATFORM, cross-compile to TARGETOS/TARGETARCH) -FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder +FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder WORKDIR /app COPY go.mod go.sum ./ RUN go mod download diff --git a/changelog.d/go-toolchain-1.26.9-cve.md b/changelog.d/go-toolchain-1.26.9-cve.md new file mode 100644 index 000000000..a3ef8e12c --- /dev/null +++ b/changelog.d/go-toolchain-1.26.9-cve.md @@ -0,0 +1,2 @@ +### Security +- **Bumped the Go toolchain to 1.26.9**, fixing [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617), an HTTP/2 server crash from an HPACK encoder race in `net/http`. Every build target (`go.mod`, the three Dockerfiles, every CI workflow) moves together, the same discipline #2956 established for the release binaries and the container image. diff --git a/cmd/discord-stats/Dockerfile b/cmd/discord-stats/Dockerfile index c14e4d606..78b68ab0f 100644 --- a/cmd/discord-stats/Dockerfile +++ b/cmd/discord-stats/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder +FROM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder WORKDIR /src COPY go.mod go.sum ./ RUN go mod download diff --git a/cmd/telemetry-server/Dockerfile b/cmd/telemetry-server/Dockerfile index 45810a138..a24d65c17 100644 --- a/cmd/telemetry-server/Dockerfile +++ b/cmd/telemetry-server/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder +FROM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder WORKDIR /src COPY go.mod go.sum ./ RUN go mod download diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 58cb1049f..69becebb4 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -33,7 +33,7 @@ to sync from until they are relinked. | Layer | Stack | Notes | |-------|-------|-------| | **HTTP router** | [chi](https://github.com/go-chi/chi) v5 | Sub-routers per resource, middleware-driven auth/CSRF/rate-limit. | -| **Backend language** | Go 1.26 (built with `golang:1.26.8-alpine`, the toolchain pinned in `go.mod`) | Standard library HTTP server, structured logging via `slog`. | +| **Backend language** | Go 1.26 (built with `golang:1.26.9-alpine`, the toolchain pinned in `go.mod`) | Standard library HTTP server, structured logging via `slog`. | | **Database** | SQLite, WAL mode | [`modernc.org/sqlite`](https://pkg.go.dev/modernc.org/sqlite) — pure Go, no CGO. Single `bindery.db` file. Connection pragmas (`foreign_keys`, `busy_timeout`, `synchronous`, `temp_store`, `cache_size`) are carried in the DSN so the driver reapplies them to every connection it opens; see [Database durability](DEPLOYMENT.md#database-durability). | | **Schema migrations** | Embedded SQL files in `internal/db/migrations/` | Linearly-numbered, additive-only, applied at startup. | | **Frontend** | React 19 + TypeScript + Tailwind CSS 4 | Built with [Vite](https://vite.dev), output baked into the binary via `go:embed`. | diff --git a/go.mod b/go.mod index 3f5ef63f5..fa691bf62 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/vavallee/bindery go 1.26.0 -toolchain go1.26.8 +toolchain go1.26.9 require ( github.com/coreos/go-oidc/v3 v3.21.0