fix(deps): require go 1.26.5 in all modules - #347
Merged
Conversation
Every module declared `go 1.26.1`. govulncheck resolves the toolchain from
that directive, so a scan of ./go ran against a go1.26.1 standard library and
reported 16 reachable vulnerabilities -- 10 of them stdlib issues fixed in
go1.26.2 through go1.26.5, none of them anything in this repo's own code.
Bumping the directive takes ./go from 16 reachable vulnerabilities to 6.
Measured, not estimated: govulncheck run against the same tree with and
without this change.
1.26.5 rather than the current 1.26.8, because the Dagger SDK refuses to
bootstrap above it:
Error: bootstrap package: existing go.mod has unsupported version 1.26.8
(highest supported version is 1.26.5)
That ceiling is why four stdlib findings survive -- GO-2026-5026, GO-2026-5972,
GO-2026-6090 and GO-2026-6218 all need go1.26.6. They are not fixable here and
will clear on their own with a Dagger engine that supports a newer toolchain.
The remaining two are genuine dependency work, tracked separately:
GO-2026-6061 google.golang.org/grpc v1.79.3 -> v1.82.1
GO-2026-4985 otel otlp http exporters v1.41.0 -> v1.43.0,
otlploghttp v0.16.0 -> v0.19.0
The otlploghttp half is awkward: v0.16.0 is one of the four `replace` pins
restored in #27, because v0.22.0 does not compile against
github.com/dagger/otel-go v1.43.0. Whether v0.19.0 clears the vulnerability
without breaking the build is untested.
Verified: `go mod tidy`, `go build` and `go vet` pass in all 28 modules, and
the diff is the directive alone -- no go.sum churn. `dagger develop -m ./kcl`
leaves the directive at 1.26.5.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76
|
🎉 This PR is included in version 0.128.5 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This was referenced Sep 5, 2026
patrick-hermann-sva
added a commit
that referenced
this pull request
Sep 5, 2026
Takes ./go from 5 reachable vulnerabilities to 1. The four remaining stdlib findings after #347 all needed go1.26.6, which the engine refused: existing go.mod has unsupported version 1.26.8 (highest supported version is 1.26.5) That ceiling is not a configured value. In cmd/codegen/generator/go/generate_module.go the limit is var goVersion = strings.TrimPrefix(runtime.Version(), "go") so it is simply the Go version the engine's codegen binary was built with. v0.21.8 was built with go1.26.5; v0.21.9 with go1.26.7. Probed it rather than inferred it: against a v0.21.9 CLI, go 1.26.6 and 1.26.7 are accepted and 1.26.8 is rejected with the ceiling reported as 1.26.7. So the go directive goes to 1.26.7, not 1.26.6 -- the extra patch is free and buys headroom before the next engine bump. GO-2026-5026, GO-2026-5972, GO-2026-6090 and GO-2026-6218 all clear. What remains is GO-2026-4985 (otlplog/otlploghttp v0.16.0 -> v0.19.0), and v0.21.9 still writes that `replace` pin as v0.16.0, so it stays blocked for the reason recorded in #350. This is a hard cut for anyone working on the repo: module requires dagger v0.21.9, but you have v0.21.8 A v0.21.8 CLI cannot load these modules at all, so everyone has to upgrade. `DAGGER_VERSION` in this-test-modules.yaml moves with it, or the job fails on exactly that error. `setup-go` reads `go-version-file: <module>/go.mod`, so the toolchain follows on its own and needs no separate pin. Generated clients are not tracked, so `dagger develop` was run with the v0.21.9 CLI in all 28 modules to make go.mod and go.sum match what CI will regenerate, rather than only editing engineVersion by hand. Verified: `go build` and `go vet` pass in all 28 modules, all 28 declare engineVersion v0.21.9 and go 1.26.7, the four otel log replace pins are untouched, and a scan of ./go on this branch reports one finding. Claude-Session: https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the govulncheck work list. All 28 modules declared
go 1.26.1.govulncheck resolves the toolchain from that directive, so scanning
./goran against a go1.26.1 standard library. Most of what it reported was not this repo's code at all — it was stdlib issues already fixed upstream.Effect
Measured, not estimated — govulncheck against the same tree with and without the change:
./gogo 1.26.1(current main, after #27)go 1.26.5(this PR)One line per module.
Why 1.26.5 and not 1.26.8
The Dagger SDK refuses to bootstrap above it:
That ceiling is not ours to raise, and it is why four stdlib findings survive this PR —
GO-2026-5026,GO-2026-5972,GO-2026-6090,GO-2026-6218all need go1.26.6. They will clear on their own with a Dagger engine that supports a newer toolchain.What is left after this
google.golang.org/grpcv1.79.3 → v1.82.1otlploghttpv0.16.0 → v0.19.0golang.org/x/netv0.52.0 → v0.55.0The
otlploghttphalf is awkward and worth flagging: v0.16.0 is one of the fourreplacepins deliberately restored in #27, because v0.22.0 does not compile againstgithub.com/dagger/otel-go v1.43.0(undefined: log.KeyValue). Whether v0.19.0 clears the vulnerability without breaking the build is untested — it sits between the two.Verification
go mod tidy,go build,go vetin all 28 modules — all pass.go.sumchurn.dagger develop -m ./kclleaves the directive at 1.26.5, so it survives regeneration.Release impact
fix:→ patch.🤖 Generated with Claude Code
https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76