fix(deps): bump supported Go versions to 1.26.6 and 1.25.13 - #819
Open
aaron-zeisler wants to merge 1 commit into
Open
fix(deps): bump supported Go versions to 1.26.6 and 1.25.13#819aaron-zeisler wants to merge 1 commit into
aaron-zeisler wants to merge 1 commit into
Conversation
Go 1.26.6 and 1.25.13 shipped on 2026-08-13 with security fixes to the go command and to crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url. Docker Scout began failing the daily security scans the following morning, reporting 8 stdlib vulnerabilities in the released images — CVE-2026-39821 (critical), CVE-2026-46600 (high), and six unspecified — all fixed in 1.26.6. Both pins matter: the Dockerfile builds the Alpine image, and go-versions.env compiles the binary copied into the distroless variants. Generated by running: ./scripts/update-go-release-version.sh 1.26.6 1.25.13
aaron-zeisler
marked this pull request as ready for review
August 14, 2026 16:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the compile-time Go versions to 1.26.6 / 1.25.13 to clear the stdlib CVEs that Docker Scout started reporting against the released images.
v9companion to #818.Background
Go 1.26.6 and 1.25.13 shipped on 2026-08-13 with security fixes to the
gocommand and tocrypto/tls,encoding/asn1,encoding/xml,html/template,net,net/http, andnet/url.This surfaced on
v8, where the daily security scans went red the following morning at an unchanged commit.v9carried the identical pins (latest=1.26.5,golang:1.26.5-alpine3.24) and therefore the same exposure — 8 stdlib vulnerabilities in one package, all fixed in 1.26.6:Both pins need to move.
Dockerfilebuilds the Alpine image directly, while.github/variables/go-versions.envdetermines the Go toolchain that compiles the binary copied into the distroless variants — those areFROM gcr.io/distroless/static-debian12, so their only Go content is the binary itself.v9needs this filed by hand:.github/workflows/check-go-versions.ymlhardcodesref: v8, so the daily bot never proposes a bump here.Changes
Generated by the repo's own script, so the diff matches what the release bot would produce on
v8:Dockerfile— builder imagegolang:1.26.5-alpine3.24→golang:1.26.6-alpine3.24.github/variables/go-versions.env—latest=1.26.6,penultimate=1.25.13scripts/verify-release-versions.shpasses and confirmsgolang:1.26.6-alpine3.24is available upstream. Alpine stays at 3.24.1 and is unaffected.Note
Overview
Updates the supported Go toolchain pins from 1.26.5 / 1.25.12 to 1.26.6 / 1.25.13 so builds and the standalone Alpine image use Go releases that fix multiple stdlib CVEs (including critical CVE-2026-39821).
Changes are limited to
go-versions.env(latestandpenultimate) and theDockerfilebuilder stage (golang:1.26.6-alpine3.24). No application or build-script logic changes.Reviewed by Cursor Bugbot for commit 10b8339. Bugbot is set up for automated code reviews on this repo. Configure here.