chore: upgrade Go toolchain (stdlib) to 1.26 to address CVE-2026-46600 - #1586
Open
claude[bot] wants to merge 2 commits into
Open
chore: upgrade Go toolchain (stdlib) to 1.26 to address CVE-2026-46600#1586claude[bot] wants to merge 2 commits into
claude[bot] wants to merge 2 commits into
Conversation
The Zoekt builder stage used golang:1.25-alpine, which ships Go stdlib 1.25.13. Parsing an invalid SVCB or HTTPS DNS resource record can panic when a parameter value size overflows the message buffer (CVE-2026-46600 / GO-2026-5942), a denial of service in the stdlib copy of golang.org/x/net/dns/dnsmessage. Upstream fixed this in Go 1.26.6 and 1.27.0-rc.3 only; the 1.25 line did not receive a backport, so clearing the advisory requires moving the builder to the 1.26 line. The floating minor tag keeps picking up patch releases, matching the convention established when the toolchain moved to 1.25. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
@claude[bot] your pull request is missing a changelog! |
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-1984
Summary
The Zoekt builder stage in the
Dockerfilebuilt againstgolang:1.25-alpine, which ships Go stdlib1.25.13. Because the Zoekt binaries are statically linked (CGO_ENABLED=0) and copied into the runtime image, that stdlib version is what Trivy reports on the published container.CVE-2026-46600 / GO-2026-5942 (HIGH): parsing an invalid SVCB or HTTPS DNS resource record can panic when the size of a parameter value overflows the message buffer, a denial of service in the stdlib copy of
golang.org/x/net/dns/dnsmessage.Upstream fixed this in Go 1.26.6 and 1.27.0-rc.3. The 1.25 line did not receive a backport, so there is no patched
1.25.xto move to. This bumps the builder base image to the 1.26 line:The floating minor tag resolves to the newest
1.26.xpatch, which is at or above the1.26.6fixed floor, and keeps picking up future patch releases. This matches the convention established when the toolchain moved to 1.25 in #1112.Scope
One line in
Dockerfile. Thego-alpinestage is used only byzoekt-builder, and the vendored Zoekt module declaresgo 1.25.0, which the 1.26 toolchain builds unchanged. No Go source,go.mod, orgo.sumchanges are involved, and the Node/Alpine stages are untouched.Verification
Dockerfile:17is the only Go toolchain pin in the repository (nosetup-gosteps, no othergolang:references).go-alpinestage feeds onlyzoekt-builder, whose static binaries are the sole source of the reportedstdlibpackage in the image.vendor/zoektsubmodule is not checked out there. The PR Gate workflow builds the image on this PR (with submodules), validating the new base image and the Zoekt build, and the nightly Trivy scan re-verifies that no affectedstdlibversion remains in the published image.🤖 Generated with Claude Code
Note
Cursor Bugbot is generating a summary for commit 9632bfc. Configure here.