Upgrade Go to 1.26.3#71
Conversation
📝 WalkthroughWalkthroughThis pull request updates the Go version used across the project: the Dockerfile's builder stage base image is bumped from ChangesGo Version Upgrade
Estimated code review effort: 1 (Trivial) | ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
5731226 to
bf62dc4
Compare
|
Needs a rebase once #72 has been merged. |
|
#72 has been merged |
|
needs rebase |
Signed-off-by: Thomas Maas <thomas@webtypes.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
Dockerfile (1)
2-2: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueFloating minor-version tag vs. pinned go.mod patch.
golang:1.26floats to the latest 1.26.x patch, whilego.modpinsgo 1.26.3. If the image's bundled toolchain is older than 1.26.3, Go's toolchain auto-download (GOTOOLCHAIN=auto by default) will fetch 1.26.3 during the build, requiring network access. This mirrors the pre-existing pattern fromgolang:1.25, so it's not a new regression, but pinning to a specific digest or patch (e.g.golang:1.26.3) would make builds more reproducible and avoid the extra download step.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` at line 2, The builder image uses a floating golang:1.26 tag while go.mod is pinned to 1.26.3, so update the Dockerfile’s builder base image to a fixed patch version or digest to keep builds reproducible and avoid triggering toolchain auto-downloads. Use the existing Dockerfile builder stage reference (the FROM --platform=$BUILDPLATFORM golang... line) and pin it to the same Go patch level as go.mod.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: Update the Go toolchain version in go.mod from 1.26.3 to 1.26.4 so the
module targets the fixed release. This is a straightforward version bump in the
go directive; keep the rest of the module file unchanged and ensure any related
build or CI references to the Go version stay consistent with the new version.
---
Nitpick comments:
In `@Dockerfile`:
- Line 2: The builder image uses a floating golang:1.26 tag while go.mod is
pinned to 1.26.3, so update the Dockerfile’s builder base image to a fixed patch
version or digest to keep builds reproducible and avoid triggering toolchain
auto-downloads. Use the existing Dockerfile builder stage reference (the FROM
--platform=$BUILDPLATFORM golang... line) and pin it to the same Go patch level
as go.mod.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| module github.com/kuadrant/developer-portal-controller | ||
|
|
||
| go 1.25.9 | ||
| go 1.26.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Go 1.26.4 release notes security fixes
💡 Result:
Go version 1.26.4 was released on June 2, 2026 [1][2]. This minor point release included three specific security fixes [3][4]: mime: quadratic complexity in WordDecoder.DecodeHeader Decoding a maliciously crafted MIME header containing many invalid encoded-words could result in excessive CPU consumption [3][4]. The MIME decoder was updated to handle this scenario more effectively [3][4]. This is tracked as CVE-2026-42504 and Go issue 79217 [4][5]. net/textproto: arbitrary input inclusion in errors Functions in the net/textproto package were previously including raw input in error messages without escaping [3][4]. Because this input is often controlled by external parties (e.g., headers parsed by a net/http client), an attacker could inject arbitrary content, such as misleading information or terminal control bytes, into logs or output [3][4]. This is tracked as CVE-2026-42507 and Go issue 79346 [3][4]. crypto/x509: quadratic verification costs The (*x509.Certificate).VerifyHostname method previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries, resulting in strings.Split(host, ".") being executed repeatedly on the same hostname [3][4]. This caused verification costs to scale quadratically based on the number of SAN entries and the hostname's label count [3][4]. The implementation was updated to split the candidate hostname only once [3][4]. This is tracked as CVE-2026-27145 and Go issue 79694 [3][4]. Beyond these security fixes, the 1.26.4 release also included various bug fixes for the compiler, the runtime, the go fix command, and the crypto/fips140 package [6][7].
Citations:
- 1: https://go.dev/doc/devel/release
- 2: https://go.googlesource.com/go/+/refs/tags/go1.26.4
- 3: https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
- 4: https://www.openwall.com/lists/oss-security/2026/06/03/2
- 5: https://seclists.org/oss-sec/2026/q2/789
- 6: https://tip.golang.org/doc/devel/release
- 7: https://golang-org.appspot.com/go.dev/doc/devel/release
Upgrade to Go 1.26.4 Go 1.26.4 includes security fixes in crypto/x509, mime, and net/textproto, so this bump should target 1.26.4 rather than 1.26.3.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, Update the Go toolchain version in go.mod from 1.26.3 to
1.26.4 so the module targets the fixed release. This is a straightforward
version bump in the go directive; keep the rest of the module file unchanged and
ensure any related build or CI references to the Go version stay consistent with
the new version.
2 participants
Upgrade Go from 1.25.9 to 1.26.3.
Changes:
go.mod: updated Go version from 1.25.9 to 1.26.3Dockerfile: updated builder image fromgolang:1.25togolang:1.26Summary by CodeRabbit