From 8cc0bd1734c9ab96e0d38dfde483fb4ba703be6c Mon Sep 17 00:00:00 2001 From: Vadim Korolik Date: Wed, 21 Oct 2026 20:52:47 +0000 Subject: [PATCH] fix(security): build with Go 1.26.10 for eMudhra intermediate distrust Go 1.26.10 makes crypto/x509 reject certificate chains through the compromised eMudhra intermediates (golang/go#82345, INC-289). This action sends LaunchDarkly API tokens over TLS, so the published image needs it. - go.mod: toolchain go1.26.8 -> go1.26.10 (go directive unchanged) - Dockerfile: builder golang:1.26.8-alpine -> golang:1.26.10-alpine - AGENTS.md: correct the stale Go version note Co-Authored-By: Claude Opus 5.5 Generated-by: termag --- AGENTS.md | 2 +- Dockerfile | 2 +- go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 7b45369d..2455b923 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -64,7 +64,7 @@ go mod tidy && go mod vendor act -e testdata/act/pull-request.json ``` -Go version comes from `go.mod` (`go-version-file: go.mod` in CI). Current module requires **Go 1.25**. +Go version comes from `go.mod` (`go-version-file: go.mod` in CI). The module targets `go 1.26.0` and pins the build toolchain with `toolchain go1.26.10`; keep the `golang:` builder image in the Dockerfile in sync. ## Changing behavior — required sync points diff --git a/Dockerfile b/Dockerfile index 43ea49c2..56f287ee 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.8-alpine AS builder +FROM golang:1.26.10-alpine AS builder RUN apk add --no-cache git diff --git a/go.mod b/go.mod index 7d59bc78..d23bbd3a 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/launchdarkly/find-code-references-in-pull-request go 1.26.0 -toolchain go1.26.8 +toolchain go1.26.10 require ( github.com/Masterminds/sprig/v3 v3.3.0