Skip to content

Upgrade Go to 1.26.3 #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eguzki merged 1 commit into from
Jul 2, 2026
Merged

Upgrade Go to 1.26.3 #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build the manager binary
FROM --platform=$BUILDPLATFORM golang:1.25 AS builder
FROM --platform=$BUILDPLATFORM golang:1.26 AS builder
ARG TARGETOS
ARG TARGETARCH
ARG GIT_SHA
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/kuadrant/developer-portal-controller

go 1.25.9
go 1.26.3

@coderabbitai coderabbitai Bot Jul 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Go 1.26.4 release notes security fixes

💡 Result:

Go version 1.26.4 was released on June 2, 2026 [1][2]. This minor point release included three specific security fixes [3][4]: mime: quadratic complexity in WordDecoder.DecodeHeader Decoding a maliciously crafted MIME header containing many invalid encoded-words could result in excessive CPU consumption [3][4]. The MIME decoder was updated to handle this scenario more effectively [3][4]. This is tracked as CVE-2026-42504 and Go issue 79217 [4][5]. net/textproto: arbitrary input inclusion in errors Functions in the net/textproto package were previously including raw input in error messages without escaping [3][4]. Because this input is often controlled by external parties (e.g., headers parsed by a net/http client), an attacker could inject arbitrary content, such as misleading information or terminal control bytes, into logs or output [3][4]. This is tracked as CVE-2026-42507 and Go issue 79346 [3][4]. crypto/x509: quadratic verification costs The (*x509.Certificate).VerifyHostname method previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries, resulting in strings.Split(host, ".") being executed repeatedly on the same hostname [3][4]. This caused verification costs to scale quadratically based on the number of SAN entries and the hostname's label count [3][4]. The implementation was updated to split the candidate hostname only once [3][4]. This is tracked as CVE-2026-27145 and Go issue 79694 [3][4]. Beyond these security fixes, the 1.26.4 release also included various bug fixes for the compiler, the runtime, the go fix command, and the crypto/fips140 package [6][7].

Citations:

Upgrade to Go 1.26.4 Go 1.26.4 includes security fixes in crypto/x509, mime, and net/textproto, so this bump should target 1.26.4 rather than 1.26.3.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 3, Update the Go toolchain version in go.mod from 1.26.3 to
1.26.4 so the module targets the fixed release. This is a straightforward
version bump in the go directive; keep the rest of the module file unchanged and
ensure any related build or CI references to the Go version stay consistent with
the new version.


require (
github.com/go-logr/logr v1.4.3
Expand Down
Loading