Repository navigation
build(go): require Go 1.27.2, so no release builds on a vulnerable stdlib - #77
Merged
Merged
Conversation
…dlib `go 1.27.0` let any 1.27.0 or 1.27.1 toolchain build the agent, and the binary then carries six HIGH stdlib vulnerabilities fixed in 1.27.2 (GO-2026-6603, 6607, 6608, 6611, 6613, 6617). `codefly publish patch` built v0.0.40 with a local go1.27.1 and its audit refused the release for exactly that. Requiring 1.27.2 makes every toolchain switch to it (GOTOOLCHAIN=auto). ci.yml and releaser.yml read the version from go.mod. The goreleaser-cross image stays v1.27.1-1: no 1.27.2 image is published on ghcr (newest v1.27.1-3), and it auto-downloads go1.27.2 when go.mod requires it. Refs #75 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why.
go 1.27.0lets a 1.27.0 or 1.27.1 toolchain build the agent. The binary then carries six HIGH stdlib vulnerabilities fixed in 1.27.2: GO-2026-6603, -6607, -6608, -6611, -6613 and -6617.codefly publish patch(CLI 0.1.185) built v0.0.40 with a local go1.27.1 after #76 merged. Its audit stage refused the release with "6 high/critical vulnerability(ies) with available upstream fixes in generic:0.0.40", and nothing was published.Change.
go.mod:go 1.27.0→go 1.27.2.go mod tidychanged nothing else.ci.ymlandreleaser.ymlreadgo-version-file: go.mod, so they follow.goreleaser-crossimage staysv1.27.1-1. No 1.27.2 image is published on ghcr (the newest 1.27 tags arev1.27.1-3/v1.27.1-3-v2.18.3), and under GOTOOLCHAIN=auto it downloads go1.27.2 when go.mod requires it.Classification: a fix, at the owner (the module's minimum Go version).
Verified locally on go1.27.2:
go build ./...,go vet ./...andgo test ./...pass.govulncheck ./...finds 0 vulnerabilities in called code. The 4 in required modules aren't reachable; two are the unpatched docker/docker advisories.Not verified: the release build inside goreleaser-cross. That happens at publish.
Refs #75
🤖 Generated with Claude Code