fix(ci): upgrade Dagger engine to v0.21.9 and Go to 1.26.7 - #352
Merged
Conversation
Takes ./go from 5 reachable vulnerabilities to 1. The four remaining stdlib findings after #347 all needed go1.26.6, which the engine refused: existing go.mod has unsupported version 1.26.8 (highest supported version is 1.26.5) That ceiling is not a configured value. In cmd/codegen/generator/go/generate_module.go the limit is var goVersion = strings.TrimPrefix(runtime.Version(), "go") so it is simply the Go version the engine's codegen binary was built with. v0.21.8 was built with go1.26.5; v0.21.9 with go1.26.7. Probed it rather than inferred it: against a v0.21.9 CLI, go 1.26.6 and 1.26.7 are accepted and 1.26.8 is rejected with the ceiling reported as 1.26.7. So the go directive goes to 1.26.7, not 1.26.6 -- the extra patch is free and buys headroom before the next engine bump. GO-2026-5026, GO-2026-5972, GO-2026-6090 and GO-2026-6218 all clear. What remains is GO-2026-4985 (otlplog/otlploghttp v0.16.0 -> v0.19.0), and v0.21.9 still writes that `replace` pin as v0.16.0, so it stays blocked for the reason recorded in #350. This is a hard cut for anyone working on the repo: module requires dagger v0.21.9, but you have v0.21.8 A v0.21.8 CLI cannot load these modules at all, so everyone has to upgrade. `DAGGER_VERSION` in this-test-modules.yaml moves with it, or the job fails on exactly that error. `setup-go` reads `go-version-file: <module>/go.mod`, so the toolchain follows on its own and needs no separate pin. Generated clients are not tracked, so `dagger develop` was run with the v0.21.9 CLI in all 28 modules to make go.mod and go.sum match what CI will regenerate, rather than only editing engineVersion by hand. Verified: `go build` and `go vet` pass in all 28 modules, all 28 declare engineVersion v0.21.9 and go 1.26.7, the four otel log replace pins are untouched, and a scan of ./go on this branch reports one finding. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76
patrick-hermann-sva
added a commit
that referenced
this pull request
Sep 5, 2026
The linting job pinned `dagger-version: v0.19.3` and `dagger-module-version: v1.17.0`. Those two are coupled: blueprints/repository-linting@v1.17.0 declares engineVersion v0.19.3, which is why the CLI was held back there. The upstream workflow's own default for dagger-version has since moved to 0.21.9, so this repo was the thing keeping the old engine alive. blueprints is at v3.2.1 now, and repository-linting there declares engineVersion v0.21.8, so it runs on the same engine as the rest of the repo after #352. Checked the call site rather than assuming the signature held. The workflow passes six flags to validate-multiple-technologies; all six still exist at v3.2.1. The version also adds --enable-pre-commit, --enable-secrets and --fail-on, all defaulting off or to "none", so it is a superset and the default behaviour is unchanged: yaml and markdown, exactly as v1.17.0 did. Confirmed by running both versions against this repo with the workflow's own arguments. Both produce 19548 lines and the output is byte-identical. `dagger-version` drops the `v` prefix to match the upstream default's format. Claude-Session: https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
🎉 This PR is included in version 0.129.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes
./gofrom 5 reachable vulnerabilities to 1.The ceiling was never a config value
The four stdlib findings left after #347 all needed go1.26.6, and the engine refused it:
In
cmd/codegen/generator/go/generate_module.gothe limit is:It is simply the Go version the engine's codegen binary was built with. v0.21.8 was built with go1.26.5, v0.21.9 with go1.26.7.
Probed rather than inferred, against an isolated v0.21.9 CLI:
godirectiveSo this goes to 1.26.7, not 1.26.6. The extra patch is free and buys headroom before the next engine bump.
Effect
./goGO-2026-5026,GO-2026-5972,GO-2026-6090,GO-2026-6218all clear.The one survivor is
GO-2026-4985(otlplog/otlploghttpv0.16.0 → v0.19.0). v0.21.9 still writes thatreplacepin as v0.16.0, so it stays blocked for the reason recorded in #350 — the SDK codegen rewrites it, and any fix there would be silently reverted by the nextdagger develop.Session total: 17 → 1.
This is a hard cut
Verified by running a v0.21.8 CLI against a module declaring v0.21.9 — it cannot load the module at all. Everyone working on this repo has to upgrade their CLI, not just CI.
DAGGER_VERSIONinthis-test-modules.yamlmoves with it or the job fails on exactly that error.setup-goreadsgo-version-file: <module>/go.mod, so the toolchain follows on its own and needs no separate pin.How the tree was produced
Generated clients are not tracked, so editing
engineVersionby hand would have leftgo.mod/go.sumdescribing the old SDK while CI regenerated against the new one.dagger developwas run with the v0.21.9 CLI in all 28 modules instead, so the committed tree matches what CI will produce.Verification
go buildandgo vetpass in all 28 modules.engineVersion: v0.21.9andgo 1.26.7.replacepins are untouched (112 occurrences, all v0.16.0)../goon this branch reports one finding.🤖 Generated with Claude Code
https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76