From 9632bfc600ccfae713d5c4b1a7cdc3ec53034655 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 08:59:01 +0000 Subject: [PATCH 1/2] chore: upgrade Go toolchain to 1.26 to address CVE-2026-46600 The Zoekt builder stage used golang:1.25-alpine, which ships Go stdlib 1.25.13. Parsing an invalid SVCB or HTTPS DNS resource record can panic when a parameter value size overflows the message buffer (CVE-2026-46600 / GO-2026-5942), a denial of service in the stdlib copy of golang.org/x/net/dns/dnsmessage. Upstream fixed this in Go 1.26.6 and 1.27.0-rc.3 only; the 1.25 line did not receive a backport, so clearing the advisory requires moving the builder to the 1.26 line. The floating minor tag keeps picking up patch releases, matching the convention established when the toolchain moved to 1.25. Co-Authored-By: Claude Opus 5 (1M context) --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index e18965663..17a85cb21 100644 --- a/Dockerfile +++ b/Dockerfile @@ -14,7 +14,7 @@ ARG NEXT_PUBLIC_SENTRY_BACKEND_DSN ARG NEXT_PUBLIC_BUILD_COMMIT_SHA FROM node:24-alpine3.23 AS node-alpine -FROM golang:1.25-alpine AS go-alpine +FROM golang:1.26-alpine AS go-alpine # ---------------------------------- # ------ Build Zoekt ------ From 59817aec1b506b519058292733e1ac4d52a727fc Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 08:59:44 +0000 Subject: [PATCH 2/2] docs: add CHANGELOG entry for Go toolchain upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 944f10305..91e17c2c1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Fixed memory leak attributed to CodeMirror allocating objects on heap that were never freed. [#1580](https://github.com/sourcebot-dev/sourcebot/pull/1580) - Kept Git provider credentials out of subprocess arguments and on-disk configuration by using isolated in-memory credential caches. [#1584](https://github.com/sourcebot-dev/sourcebot/pull/1584) +- Upgraded the Go toolchain used to build Zoekt to `1.26`. [#1586](https://github.com/sourcebot-dev/sourcebot/pull/1586) ## [5.1.7] - 2026-08-13