Repository navigation
fix: bump Go to 1.26.10 for CVE-2026-111943 - #424
Closed
Wei Weng (weng271190436) wants to merge 1 commit into
Closed
Wei Weng (weng271190436) wants to merge 1 commit into
Wei Weng (weng271190436) wants to merge 1 commit into
Conversation
Update the module minimum, controller builder images, and CI toolchains to the patched Go release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Wei Weng <Wei.Weng@microsoft.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #424 +/- ##
==========================================
- Coverage 67.06% 66.96% -0.11%
==========================================
Files 34 34
Lines 3859 3859
==========================================
- Hits 2588 2584 -4
- Misses 1090 1094 +4
Partials 181 181 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
What this PR does / why we need it:
Upgrade Go from 1.26.9 to 1.26.10 to address CVE-2026-111943 (GO-2026-6809), distrust of compromised intermediate certificates in crypto/x509.
Keep the module Go directive, all four controller/installer Docker builder images, and all six CI/build workflow toolchains aligned. No application code or dependency versions change.
Which issue(s) this PR fixes:
Addresses https://pkg.go.dev/vuln/GO-2026-6809. No repository issue linked.
Requirements:
make reviewablefor basic local testHow has this code been tested
Using Go 1.26.10:
make reviewable— passed (formatting, vet, lint, staticcheck, module tidy).go test ./pkg/common/...— passed.go build ./cmd/...— passed.git diff --check— passed.Special notes for your reviewer
This updates source-repository build settings. Existing published images must be rebuilt and released to pick up the fix. If a downstream build system selects its own Go toolchain, it must also use a fixed release.