Repository navigation
chore(deps): update go to 1.26.10 and x/net to v0.60.0 (release-4.0) - #17262
Merged
Merged
Conversation
Go 1.25 is end of life and will not get the crypto/x509 fix for CVE-2026-111943, and golang.org/x/net v0.60.0 (security) needs Go 1.26. Move release-4.0 to Go 1.26.10 and take the x/net set (x/crypto v0.57.0, x/sync, x/sys, x/term, x/text) in the main and SDK modules. Add `godebug default=go1.25` so the binaries keep the 1.25 GODEBUG defaults (tlssecpmlkem, urlstrictcolons, httpservecontentmaxranges, cryptocustomrand) in this patch release. Bump golangci-lint to v2.11.3, which is built with Go 1.26, and fix its new noctx and nolintlint findings. Replace the deprecated http2.Transport in the e2e client, as on main and release-4.1. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014BhuQwzc8b4XKuHRfNuvvb Signed-off-by: Alan Clucas <alan@clucas.org>
With a major.minor spec such as "1.26", setup-go uses any matching Go in the runner's tool cache without checking for a newer patch. After a Go patch bump in go.mod, jobs then fail with GOTOOLCHAIN=local until the runner image catches up. Read the exact version from go.mod instead. setup-go downloads it when the cache doesn't have it, and go.mod becomes the only place to bump. pr.yaml keeps its spec because it sets up Go before checkout. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014BhuQwzc8b4XKuHRfNuvvb Signed-off-by: Alan Clucas <alan@clucas.org>
4 of 6 tasks
The new image takes the Debian ca-certificates update that removes the "AAA Certificate Services" (Comodo) and "emSign ECC Root CA - G3" roots, which upstream now treats as untrusted. It lands alongside the Go crypto/x509 distrust fix for CVE-2026-111943. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014BhuQwzc8b4XKuHRfNuvvb Signed-off-by: Alan Clucas <alan@clucas.org>
Joibel
marked this pull request as ready for review
October 21, 2026 16:06
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See the pull request guide for details on each item.
make pre-commit -Bmake feature-new)Motivation
release-4.0 builds with Go 1.25, which went end of life when Go 1.27.0 shipped on 2026-08-19, so it won't get the Go 1.26.10 / 1.27.3
crypto/x509security fix (CVE-2026-111943, golang/go#82345, 2026-10-19). That fix makes Go distrust a set of intermediates from one certificate authority, and it isn't gated by GODEBUG, so thegodebugpin below doesn't turn it off. 4.0 is also stuck on two security dependency bumps.golang.org/x/netv0.60.0 (#17178, closed) andgolang.org/x/cryptov0.56.0 (#16837) both declarego 1.26.0, so neither can land while the branch is on 1.25.This moves 4.0 to Go 1.26.10, the same Go line as release-4.1, and takes the x/net set in the same change. It supersedes #16837.
Modifications
go 1.26.10ingo.modand thesdks/gomodules, plus the SDK README, both Dockerfiles, the devcontainer,setup-goin the workflows, and the nix overlay (go_1_26/buildGo126Module).godebug default=go1.25ingo.mod. Thegodirective sets the binaries' GODEBUG defaults, so this keeps the controller, server, executor and CLI on exactly the 1.25.12 defaults (cryptocustomrand=1,httpservecontentmaxranges=1,tlssecpmlkem=0,urlstrictcolons=0, checked withgo list -f '{{.DefaultGODEBUG}}'). Without it, the patch release would start offering extra post-quantum TLS key exchanges and parse URL hosts more strictly.golang.org/x/netv0.58.0 → v0.60.0, which brings in x/crypto v0.57.0, x/sync v0.23.0, x/sys v0.48.0, x/term v0.46.0 and x/text v0.42.0. Done in the main module and all five SDK modules.httptest.NewRequestcalls now pass a context (the same change as on main), and nine// nolint:directives become//nolint:.http2.Transport, so the e2e client now useshttp.Transportwith unencrypted HTTP/2, the same as main (fix(build): run mockery and golangci-lint under the go.mod toolchain, drop deprecated http2.Transport #17182) and release-4.1 (fix(build): drop deprecated http2.Transport (cherry-pick #17182 for 4.1) #17185). x/net is now only an indirect dependency.static-debian13base image digest moved to034df5c. It carries the Debian ca-certificates update that removes the "AAA Certificate Services" (Comodo) and "emSign ECC Root CA - G3" roots, which upstream now treats as untrusted (backout ca-certificates workaround, revert to debian update that removes them GoogleContainerTools/distroless#2218). Go's fix filters specific intermediates during verification; this drops the roots from the image's trust store as well.setup-gosteps now take the version fromgo.mod(go-version-file: go.mod), so CI doesn't wait for the runner image to cache the new patch (the same change as ci: take the setup-go version from go.mod #17263 on main).Some Go 1.26 changes are outside GODEBUG and do reach 4.0 users. The release note should mention them:
http.ServeMuxtrailing-slash redirects are now 307 instead of 301.http.Clientcookie scoping now usesRequest.Host.main and release-4.1 already ship all of these.
The nix build will fail until the flake lock reaches a nixpkgs with go 1.26.10. nixpkgs-unstable is still on 1.26.9, and release-4.0 CI doesn't use nix.
Verification
make codegen -B(no diff),make lint-go(0 issues) andmake testunder Go 1.26.10. The only failures wereTestEmissary/Sub-processandTestSimpleStartCloser, which only fail locally (a shellecho "\c"quirk).go build ./...in the main module and each SDK module after the x/net bump.Documentation
Not needed beyond the release note above.
AI
I used Claude Code (Claude Opus 5.5) for the version sweep, the lint fixes, checking the GODEBUG defaults, and running codegen, lint and tests. I've reviewed the diff.
🤖 Generated with Claude Code
https://claude.ai/code/session_014BhuQwzc8b4XKuHRfNuvvb