From 00ac1cfb353346b89684642bb63a0f37c0da149e Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Fri, 14 Aug 2026 10:37:29 +0200 Subject: [PATCH 1/2] sec(deps): bump the build toolchain to go1.26.6 (backend#1972) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `govulncheck` reports four CALLED stdlib vulnerabilities on go1.26.5 — reached from this module's own code, not merely present in the dependency graph: GO-2026-6218 net/url quadratic complexity in resolvePath GO-2026-6090 crypto/tls post-handshake message flood GO-2026-5972 encoding/asn1 unbounded recursion depth GO-2026-5026 net/http x/net/idna Punycode label handling All four are fixed in go1.26.6, and none needs a code or dependency change. Every workflow resolves Go through `go-version-file: go.mod`, so this one line moves build.yml, golangci.yml, e2e.yml, mutation.yml, release.yml and chart-drift.yml together. `go 1.26.0` is deliberately untouched — that is the language floor, not the toolchain, and .golangci.yml's `go: "1.26"` tracks it. Only the compiler moves. ## Evidence, on a real toolchain rather than from release notes GOTOOLCHAIN=auto fetched go1.26.6 and used it: go version go1.26.6 darwin/amd64 (downloaded on demand) go build ./... exit 0 go vet ./... exit 0 go test ./... exit 0 (all packages ok) govulncheck ./... exit 0 "No vulnerabilities found." Counterfactual, so the bump is demonstrably what fixed it rather than something incidental — reverted the single line and re-ran the same binary: toolchain go1.26.5 -> exit 3, 4 vulnerabilities (the four above) toolchain go1.26.6 -> exit 0, none Exit codes read explicitly: govulncheck exits 3 on findings, so "looks clean" in the output is not the same as passing. ## What is NOT in this PR Making `govulncheck` a required status check. It is red-on-main today and the prod promotion merged straight past it, which is the actual defect — filed as backend#1972. It must be armed only AFTER this reaches `main`: adding the context while main is still on go1.26.5 would block every release-train promotion on the branch the train has to merge into. Fix first, arm second. --- go.mod | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 2d218e6..d968e70 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,30 @@ go 1.26.0 // Pin the build toolchain to the latest 1.26.x patch so release binaries // pick up stdlib security fixes (GO-2026-5856 needs go1.26.5; three more // stdlib CVEs need go1.26.4). Bump this on each Go patch release. -toolchain go1.26.5 +// +// go1.26.6 clears four stdlib vulnerabilities govulncheck reports as CALLED +// from this module — not merely present in the dependency graph: +// +// GO-2026-6090 crypto/tls post-handshake message flood +// <- api.userAgentTransport.RoundTrip, submit.HTTPSubmitter.Submit +// GO-2026-5972 encoding/asn1 unbounded recursion depth +// <- submit.PortForwardJobsManager -> spdy.RoundTripperFor +// GO-2026-5026 net/http x/net/idna Punycode label handling +// <- api.userAgentTransport.RoundTrip, submit.HTTPSubmitter.Submit +// GO-2026-6218 net/url quadratic complexity in resolvePath +// <- submit.HTTPSubmitter.Submit, schema.NewV1Validator +// +// All four are fixed in go1.26.6 and none needs a code or dependency change, +// because every workflow resolves Go through `go-version-file: go.mod` — so +// this line is the whole fix for build.yml, golangci.yml, e2e.yml, mutation.yml, +// release.yml and chart-drift.yml at once. +// +// Found on the 2026-08-14 prod hop: `govulncheck` went red on the main tip and +// the promotion merged anyway, because it is NOT one of this repo's required +// status checks (backend#1972). Making it required is deliberately a SEPARATE +// change, and only after this reaches main — arming that gate first would block +// every promotion on a branch that is still on go1.26.5. +toolchain go1.26.6 require ( github.com/AlecAivazis/survey/v2 v2.3.7 From 528ddfbcf2effb0586b0127913b95b95293c6cb6 Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Fri, 14 Aug 2026 10:42:34 +0200 Subject: [PATCH 2/2] chore(release): bump VERSION to 0.10.7 for the toolchain fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The version-bump gate caught what I left out: v0.10.6 is already released, and this PR changes `go.mod` — a published path — so the binary the train ships would differ from the one v0.10.6 tagged. The gate's own wording is the reason this matters: the train reads VERSION and cuts the tag from it, never bumping for you, so a stale file does not fail here — it fails the next prod hop, days later, on somebody else (backend#1561). Patch bump: stdlib security fixes via go1.26.6, no behaviour or API change. --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 69da6eb..2d993c4 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.10.6 +0.10.7