Repository navigation
fix(deps): build with Go 1.26.10 for the eMudhra CA blocklist (FB-5055) - #88
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kop
pushed a commit
that referenced
this pull request
Oct 26, 2026
🤖 I have created a release *beep* *boop* --- ## [0.7.0](v0.6.0...v0.7.0) (2026-10-26) ### ⚠ BREAKING CHANGES * **server:** add streamable-http transport ([#81](#81)) ### Features * **server:** add streamable-http transport ([#81](#81)) ([9713ba4](9713ba4)) ### Bug Fixes * **deps:** build with Go 1.26.10 for the eMudhra CA blocklist (FB-5055) ([#88](#88)) ([784fca2](784fca2)) * **server:** block cross-site tool calls and drain requests on shutdown ([#82](#82)) ([bf68432](bf68432)) * validate database connection parameters ([#79](#79)) ([d240c04](d240c04)) ### Dependencies * **github-actions:** bump the github-actions-deps group across 1 directory with 7 updates ([#77](#77)) ([d9f59ba](d9f59ba)) * **gomod:** bump github.com/antchfx/xpath from 1.3.5 to 1.3.6 ([#76](#76)) ([08332f3](08332f3)) * **gomod:** bump github.com/klauspost/compress from 1.18.2 to 1.18.7 ([#87](#87)) ([feec202](feec202)) * **gomod:** bump golang.org/x/sync from 0.20.0 to 0.24.0 in the go-deps group ([#85](#85)) ([2bae7dd](2bae7dd)) * **gomod:** bump the go-deps group across 1 directory with 8 updates ([#84](#84)) ([aafedab](aafedab)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Diff is version manifest, changelog, and README tag updates only; no runtime code changes in this PR. > > **Overview** > **Release Please** bumps the project from **0.6.0** to **0.7.0** in `.github/release-please/manifest.json`, adds the **0.7.0** section to `CHANGELOG.md`, and updates pinned Docker image tags and release URLs in `README.md` (install, Claude Desktop, Firebolt Core examples). > > This PR does not change server code; it packages already-merged work. The new changelog entry calls out a **breaking** **streamable-http** transport, plus security/behavior fixes (cross-site tool-call blocking, shutdown draining, DB connection validation), Go **1.26.10** for the eMudhra CA blocklist, and routine dependency bumps. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e33a069. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The published
ghcr.io/firebolt-db/mcp-server:latestimage (built 2026-01-26) trusts the compromisedemSign ECC Root CA - G3andAAA Certificate Servicesroots: its distroless CA bundle predates the Debian fix. The server makes TLS calls to the Firebolt API from customer machines, so a MITM with one of the leaked eMudhra intermediates would be accepted.goin go.mod from 1.26.0 to 1.26.10, the first 1.26 patch with the eMudhra blocklist (CVE-2026-111943). setup-go installs exactly this version viago-version-file, so release binaries get it.gcr.io/distroless/base:nonroot. Its current digest (f9518b74…) is clean (checked by certificate subject with openssl), so the next release build picks up the fix.fix:so release-please cuts a release. The image only gets rebuilt once the release PR (currently #80) is merged.go build ./...andgo test ./...pass locally.🤖 Generated with Claude Code
Note
Medium Risk
Toolchain bump changes default TLS root trust for outbound API calls; scope is limited to the Go version pin with no application logic changes.
Overview
Bumps the required Go toolchain from
1.26.0to1.26.10so CI and release builds (viago-version-file: go.modin test/release workflows) compile with the first 1.26 patch that includes the eMudhra root CA blocklist (CVE-2026-111943).This addresses trust in compromised eMudhra-related roots for outbound TLS to the Firebolt API; it does not change application code—only the minimum Go version declared in
go.mod.Reviewed by Cursor Bugbot for commit fd36791. Bugbot is set up for automated code reviews on this repo. Configure here.