From 812e884a31cf8c276b27f08d3ce4070b672414e9 Mon Sep 17 00:00:00 2001 From: Rayhan Hossain Date: Wed, 21 Oct 2026 13:54:36 -0700 Subject: [PATCH] fix: update Go to 1.26.10 for vulnerability checks Raise all six modules to the patched Go release for GO-2026-6809. Align unit workflows with go.mod and pin the three Go builder images so container binaries receive the fix as well. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 33b3cb3c-1b25-4ffb-bff1-ebf0f3d04058 Signed-off-by: Rayhan Hossain --- .github/workflows/test-unit-coverage.yml | 5 +---- .github/workflows/test-unit.yml | 5 +---- CHANGELOG.md | 5 +++++ docs/designs/image-management.md | 2 +- documentdb-kubectl-plugin/go.mod | 2 +- operator/cnpg-plugins/sidecar-injector/Dockerfile | 2 +- operator/cnpg-plugins/sidecar-injector/go.mod | 2 +- operator/src/Dockerfile | 2 +- operator/src/go.mod | 2 +- test/e2e/go.mod | 2 +- test/longhaul/Dockerfile | 2 +- test/longhaul/go.mod | 2 +- test/shared/go.mod | 2 +- 13 files changed, 17 insertions(+), 18 deletions(-) diff --git a/.github/workflows/test-unit-coverage.yml b/.github/workflows/test-unit-coverage.yml index bbd2d58cd..9745b3971 100644 --- a/.github/workflows/test-unit-coverage.yml +++ b/.github/workflows/test-unit-coverage.yml @@ -13,9 +13,6 @@ permissions: contents: read pull-requests: write -env: - GO_VERSION: '1.26.6' - jobs: coverage: name: Check Unit Test Coverage @@ -33,7 +30,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: ${{ env.GO_VERSION }} + go-version-file: operator/src/go.mod cache-dependency-path: operator/src/go.sum - name: Download dependencies diff --git a/.github/workflows/test-unit.yml b/.github/workflows/test-unit.yml index 6218d293a..d9cedf843 100644 --- a/.github/workflows/test-unit.yml +++ b/.github/workflows/test-unit.yml @@ -19,9 +19,6 @@ on: permissions: contents: read -env: - GO_VERSION: '1.26.6' - jobs: unit-test: name: Run Unit Tests @@ -37,7 +34,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: ${{ env.GO_VERSION }} + go-version-file: operator/src/go.mod cache-dependency-path: operator/src/go.sum - name: Download dependencies diff --git a/CHANGELOG.md b/CHANGELOG.md index b9f93246a..3ddded593 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## [Unreleased] + +### Security +- Require Go 1.26.10 across all six modules and pin Go builder images to that patch release to address [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809) in `crypto/x509`. Unit-test workflows now resolve Go from the operator module instead of an older hard-coded version. + ## [1.0.0] - 2026-10-19 First generally available operator release, for DocumentDB 1.0. The operator and the DocumentDB engine keep separate version numbers; this chart deploys engine `1.0.0` (extension schema `1.0-0`) by default. See [Upgrading to DocumentDB 1.0](docs/operator-public-documentation/preview/operations/upgrades.md#upgrading-to-documentdb-10). diff --git a/docs/designs/image-management.md b/docs/designs/image-management.md index c66ffbf00..c87ca7dcb 100644 --- a/docs/designs/image-management.md +++ b/docs/designs/image-management.md @@ -234,7 +234,7 @@ The build process: ### Dockerfile Details #### Operator (`operator/src/Dockerfile`) -- **Base**: `mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0` → `scratch` +- **Base**: `mcr.microsoft.com/oss/go/microsoft/golang:1.26.10-azurelinux3.0` → `scratch` - **Multi-stage**: 2 stages (builder → scratch) - **Entrypoint**: `/manager` diff --git a/documentdb-kubectl-plugin/go.mod b/documentdb-kubectl-plugin/go.mod index 4bcb4c3b3..4ba51a5d4 100644 --- a/documentdb-kubectl-plugin/go.mod +++ b/documentdb-kubectl-plugin/go.mod @@ -1,6 +1,6 @@ module github.com/documentdb/documentdb-operator/documentdb-kubectl-plugin -go 1.26.9 +go 1.26.10 require ( github.com/documentdb/documentdb-operator v0.0.0 diff --git a/operator/cnpg-plugins/sidecar-injector/Dockerfile b/operator/cnpg-plugins/sidecar-injector/Dockerfile index 11730dc0a..b58cb59d5 100644 --- a/operator/cnpg-plugins/sidecar-injector/Dockerfile +++ b/operator/cnpg-plugins/sidecar-injector/Dockerfile @@ -5,7 +5,7 @@ ARG TARGETOS ARG TARGETARCH ARG ARCH -FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0 AS builder +FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26.10-azurelinux3.0 AS builder # Cache the dependencies diff --git a/operator/cnpg-plugins/sidecar-injector/go.mod b/operator/cnpg-plugins/sidecar-injector/go.mod index f2fb077e2..892666472 100644 --- a/operator/cnpg-plugins/sidecar-injector/go.mod +++ b/operator/cnpg-plugins/sidecar-injector/go.mod @@ -1,6 +1,6 @@ module github.com/documentdb/cnpg-i-sidecar-injector -go 1.26.9 +go 1.26.10 require ( github.com/cloudnative-pg/api v1.25.1 diff --git a/operator/src/Dockerfile b/operator/src/Dockerfile index ff8e0b5f6..76abadf22 100644 --- a/operator/src/Dockerfile +++ b/operator/src/Dockerfile @@ -5,7 +5,7 @@ ARG TARGETOS ARG TARGETARCH ARG ARCH -FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0 AS builder +FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26.10-azurelinux3.0 AS builder WORKDIR /workspace # Copy the Go Modules manifests diff --git a/operator/src/go.mod b/operator/src/go.mod index abc9934b4..8e3fafd76 100644 --- a/operator/src/go.mod +++ b/operator/src/go.mod @@ -1,6 +1,6 @@ module github.com/documentdb/documentdb-operator -go 1.26.9 +go 1.26.10 godebug default=go1.23 diff --git a/test/e2e/go.mod b/test/e2e/go.mod index 20ae306f9..269ad2ee6 100644 --- a/test/e2e/go.mod +++ b/test/e2e/go.mod @@ -1,6 +1,6 @@ module github.com/documentdb/documentdb-operator/test/e2e -go 1.26.9 +go 1.26.10 require ( github.com/cloudnative-pg/cloudnative-pg v1.29.2 diff --git a/test/longhaul/Dockerfile b/test/longhaul/Dockerfile index 506e5e909..c83a0217e 100644 --- a/test/longhaul/Dockerfile +++ b/test/longhaul/Dockerfile @@ -9,7 +9,7 @@ # # docker build -f test/longhaul/Dockerfile -t /longhaul-test:latest . # -FROM golang:1.26-alpine AS builder +FROM golang:1.26.10-alpine AS builder # Note: the golang:*-alpine image already ships ca-certificates, and all # deps in go.mod resolve via proxy.golang.org (no VCS fetches), so neither diff --git a/test/longhaul/go.mod b/test/longhaul/go.mod index 22e9058d0..5424fddeb 100644 --- a/test/longhaul/go.mod +++ b/test/longhaul/go.mod @@ -1,6 +1,6 @@ module github.com/documentdb/documentdb-operator/test/longhaul -go 1.26.9 +go 1.26.10 require ( github.com/cloudnative-pg/cloudnative-pg v1.29.2 diff --git a/test/shared/go.mod b/test/shared/go.mod index 15fd6b702..cf6ac3a33 100644 --- a/test/shared/go.mod +++ b/test/shared/go.mod @@ -1,6 +1,6 @@ module github.com/documentdb/documentdb-operator/test/shared -go 1.26.9 +go 1.26.10 require ( github.com/cloudnative-pg/cloudnative-pg v1.29.2