From 51855baa8bad0dbe72b1eb711f1206e5eb6edf93 Mon Sep 17 00:00:00 2001 From: August Felso <77752049+amfelso@users.noreply.github.com> Date: Wed, 26 Aug 2026 19:21:39 -0400 Subject: [PATCH] CP-46909: Bump Go toolchain to 1.26.7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Grype image scan in the DockerBuild workflow began failing on every open branch on 2026-08-26, after the vulnerability database was rebuilt (v6.1.9, built 06:18Z). The scan flags six High-severity Go standard library advisories against the go1.26.5 stdlib recorded in every binary we ship, all of them fixed in 1.26.6: GO-2026-5026 GO-2026-5942 GO-2026-5972 GO-2026-6088 GO-2026-6089 GO-2026-6090 The last DockerBuild run on develop predates the database rebuild, so develop has never been scanned against these advisories. This is not caused by any dependency change; it blocks all 15 open branches equally. Implementation Approach: scripts/ci-checks.sh requires the Go version to agree across every Dockerfile and every go.mod in the repository. Dependabot can only edit the Dockerfile it owns, which is why #967 could bump docker/Dockerfile but failed custom-checks — the go.mod directives disagreed. A coordinated bump across all seven references is the only shape that satisfies the check, and it cannot come from Dependabot. 1.26.7 is the current 1.26.x patch release. Staying on the 1.26 series keeps this a patch-level change; the 1.27.0 bump Dependabot proposed in #967 is a language minor-version change and is better reviewed on its own. Functional Requirements: 1. The shipped binaries must record a stdlib version at or above 1.26.6. Bumped the builder image to golang:1.26.7-alpine in docker/Dockerfile, tests/docker/Dockerfile.smoke-tests and tests/integration/test_server/Dockerfile. 2. The Go version must remain consistent repository-wide. Bumped the go directive to 1.26.7 in go.mod, tests/go.mod, .tools/go.mod and tests/integration/test_server/go.mod. Validation: - scripts/ci-checks.sh passes locally, confirming version consistency. - Reproduced the original failure locally with grype 0.117.0 against ghcr.io/cloudzero/untested-cloudzero/untested-cloudzero-agent:pr-982, confirming all six findings resolve to the stdlib in the built binaries rather than to any dependency. - Confirmed golang:1.26.7-alpine exists and carries no High-or-above findings in the packages that reach the final image. Supersedes #967. Co-Authored-By: Claude Opus 5 (1M context) --- .tools/go.mod | 2 +- docker/Dockerfile | 2 +- go.mod | 2 +- tests/docker/Dockerfile.smoke-tests | 2 +- tests/go.mod | 2 +- tests/integration/test_server/Dockerfile | 2 +- tests/integration/test_server/go.mod | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.tools/go.mod b/.tools/go.mod index 852382885..d7b2b109f 100644 --- a/.tools/go.mod +++ b/.tools/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent/.tools -go 1.26.5 +go 1.26.7 require ( github.com/homeport/dyff v1.12.0 diff --git a/docker/Dockerfile b/docker/Dockerfile index ff592efcb..26f8b2fdc 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -14,7 +14,7 @@ ARG RELOADER_VERSION=v0.91.0 # 7. final: Minimal runtime image with compiled binaries # Stage 1: Base tools installation -FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS base-tools +FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS base-tools ARG TARGETPLATFORM ARG TARGETOS TARGETARCH diff --git a/go.mod b/go.mod index aff54f4a3..5e5841f4c 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent -go 1.26.5 +go 1.26.7 require ( github.com/google/go-cmp v0.7.0 diff --git a/tests/docker/Dockerfile.smoke-tests b/tests/docker/Dockerfile.smoke-tests index c94fbd515..850e745b2 100644 --- a/tests/docker/Dockerfile.smoke-tests +++ b/tests/docker/Dockerfile.smoke-tests @@ -8,7 +8,7 @@ # components, avoiding the need to build and coordinate multiple images. # Stage 1: Base tools installation -FROM golang:1.26.5-alpine AS base-tools +FROM golang:1.26.7-alpine AS base-tools WORKDIR /app # Install system packages needed for building diff --git a/tests/go.mod b/tests/go.mod index e0f23aab2..1c2d13d26 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent/tests -go 1.26.5 +go 1.26.7 require ( github.com/andybalholm/brotli v1.2.2 diff --git a/tests/integration/test_server/Dockerfile b/tests/integration/test_server/Dockerfile index c17823fbe..3a1c083cd 100644 --- a/tests/integration/test_server/Dockerfile +++ b/tests/integration/test_server/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5 +FROM golang:1.26.7 WORKDIR /app diff --git a/tests/integration/test_server/go.mod b/tests/integration/test_server/go.mod index 8c652bf2d..f74579297 100644 --- a/tests/integration/test_server/go.mod +++ b/tests/integration/test_server/go.mod @@ -1,5 +1,5 @@ module main -go 1.26.5 +go 1.26.7 require github.com/golang/snappy v1.0.0