From f4c9f2beeb92d1639eebce7d6fbef60ea3f4db81 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 1 Nov 2026 11:45:39 +0100 Subject: [PATCH] FLEX-WP-0040-T07: build with Go 1.26.10 (stdlib HIGH CVEs) Founder decision 2026-11-01: the v14 release must meet the zero HIGH/CRITICAL bar. Trivy found CVE-2026-111943, -78667, -78669 and -97031 in Go stdlib 1.26.7 (fixed in 1.26.9/1.26.10). Builder image golang:1.26.10-alpine (index sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308) and go.mod go 1.26.10; runtime base unchanged. make test (race), go vet and both compact-sitting policy packages (v14 46 tests, v13 32 tests) pass on go1.26.10. Containerfile and go.mod trigger .forgejo/workflows/image.yaml. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- Containerfile | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Containerfile b/Containerfile index 56ba921..38696b3 100644 --- a/Containerfile +++ b/Containerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.7-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS build +FROM golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS build WORKDIR /src COPY go.mod go.sum ./ # Portable, unchanged Approval-owner pure data helper; available before download. diff --git a/go.mod b/go.mod index 86a6104..1974efc 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/netkingdom/access-engine -go 1.26.7 +go 1.26.10 require ( github.com/netkingdom/approval-engine/adapters/go/approvalfact v0.0.0