fix: update Go to 1.26.10 for vulnerability checks

.github/workflows/test-unit-coverage.yml

@@ -13,9 +13,6 @@ permissions:
   contents: read
   pull-requests: write
 
-env:
-  GO_VERSION: '1.26.6'
-
 jobs:
   coverage:
     name: Check Unit Test Coverage
@@ -33,7 +30,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: operator/src/go.mod
           cache-dependency-path: operator/src/go.sum
 
       - name: Download dependencies

.github/workflows/test-unit.yml

@@ -19,9 +19,6 @@ on:
 permissions:
   contents: read
 
-env:
-  GO_VERSION: '1.26.6'
-
 jobs:
   unit-test:
     name: Run Unit Tests
@@ -37,7 +34,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: operator/src/go.mod
           cache-dependency-path: operator/src/go.sum
 
       - name: Download dependencies

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [Unreleased]
+
+### Security
+- Require Go 1.26.10 across all six modules and pin Go builder images to that patch release to address [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809) in `crypto/x509`. Unit-test workflows now resolve Go from the operator module instead of an older hard-coded version.
+
 ## [1.0.0] - 2026-10-19
 
 First generally available operator release, for DocumentDB 1.0. The operator and the DocumentDB engine keep separate version numbers; this chart deploys engine `1.0.0` (extension schema `1.0-0`) by default. See [Upgrading to DocumentDB 1.0](docs/operator-public-documentation/preview/operations/upgrades.md#upgrading-to-documentdb-10).

docs/designs/image-management.md

@@ -234,7 +234,7 @@ The build process:
 ### Dockerfile Details
 
 #### Operator (`operator/src/Dockerfile`)
-- **Base**: `mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0` → `scratch`
+- **Base**: `mcr.microsoft.com/oss/go/microsoft/golang:1.26.10-azurelinux3.0` → `scratch`
 - **Multi-stage**: 2 stages (builder → scratch)
 - **Entrypoint**: `/manager`
 

documentdb-kubectl-plugin/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/documentdb-kubectl-plugin
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/documentdb/documentdb-operator v0.0.0

operator/cnpg-plugins/sidecar-injector/Dockerfile

@@ -5,7 +5,7 @@
 ARG TARGETOS
 ARG TARGETARCH
 ARG ARCH
-FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0 AS builder
+FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26.10-azurelinux3.0 AS builder
 
 
 # Cache the dependencies

operator/cnpg-plugins/sidecar-injector/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/cnpg-i-sidecar-injector
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/cloudnative-pg/api v1.25.1

operator/src/Dockerfile

@@ -5,7 +5,7 @@
 ARG TARGETOS
 ARG TARGETARCH
 ARG ARCH
-FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0 AS builder
+FROM --platform=${TARGETOS:-linux}/${ARCH:-${TARGETARCH}} mcr.microsoft.com/oss/go/microsoft/golang:1.26.10-azurelinux3.0 AS builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests

operator/src/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator
 
-go 1.26.9
+go 1.26.10
 
 godebug default=go1.23
 

test/e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/test/e2e
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/cloudnative-pg/cloudnative-pg v1.29.2

test/longhaul/Dockerfile

@@ -9,7 +9,7 @@
 #
 #   docker build -f test/longhaul/Dockerfile -t <registry>/longhaul-test:latest .
 #
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26.10-alpine AS builder
 
 # Note: the golang:*-alpine image already ships ca-certificates, and all
 # deps in go.mod resolve via proxy.golang.org (no VCS fetches), so neither

test/longhaul/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/test/longhaul
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/cloudnative-pg/cloudnative-pg v1.29.2

test/shared/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/test/shared
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/cloudnative-pg/cloudnative-pg v1.29.2