[cristim]

Summary

• Go 1.26.6 -> 1.26.9 everywhere it is pinned: go.mod, go.work, Dockerfile, Dockerfile.dev, Dockerfile.test (new index digest for golang:1.26.9-alpine3.24), CI GO_VERSION, and the docs that quote it.
• golang.org/x/net v0.58.0 -> v0.60.0 (go get + go mod tidy; tidy also moved x/crypto, x/sync, x/sys, x/text to newer minimum-compatible releases).
• Fixes the failing "Security Scanning" govulncheck step and the "Scan the shipped image for Go advisories" step, which fail on main (e5baaab) and block every platform PR.

Verification (local, go1.26.9, macOS)

• go build ./... and go vet ./...: clean.
• govulncheck ./... (pinned v1.1.4, as CI) exit 0 in the root module and in tests/e2e.
• go test for internal/api, internal/server, cmd/...: pass, one package at a time. x/net is only an indirect dependency (no direct importers in this repo).
• Not verified locally: the Docker image build and shipped-image scan (no Docker run, per the disk rules); CI covers them.

---

Update: cherry-picked #687's handlebars lockfile commit (1a4616e, reviewed clean) as 42691de so this PR carries both fixes; #687 and #693 were each red only on the other's advisory. #687 will be closed as superseded.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 10 billable files and costs up to $2.50.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 31 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 82 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 53c4d962-2179-446d-bbf9-2b74196fff74

---

📥 Commits

Reviewing files that changed from the base of the PR and between e5baaab and 42691de.

---

⛔ Files ignored due to path filters (2)

• go.sum is excluded by !**/*.sum
• go.work is excluded by !**/*.work

---

📒 Files selected for processing (10)

• .github/workflows/README.md
• .github/workflows/ci.yml
• CONTRIBUTING.md
• Dockerfile
• Dockerfile.dev
• Dockerfile.test
• docs/DEPLOYMENT.md
• docs/DEVELOPMENT.md
• frontend/package-lock.json
• go.mod

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review: APPROVE at 8f4dd820d02e074accea6ea06fb7269e49dd6080

Reviewer: archera-quotes-codex. I did not write this PR. Base: e5baaabd.

Pins are consistent.

• go.mod and go.work both say go 1.26.9, and CI GO_VERSION is '1.26.9'.
  • All 6 ci.yml setup-go steps read env.GO_VERSION.
  • database-migration.yml and pre-commit.yml use go-version-file: go.mod.
• There is no toolchain directive, .tool-versions or .go-version.
• tests/e2e stays at go 1.25; it is a stdlib-only floor.
• The only 1.26.6 left outside frontend/ is the historical audit doc.

The base image digest is correct.

• All three Dockerfiles use golang:1.26.9-alpine3.24@sha256:cdfd4fe2…84e0.
• The Docker Hub registry HEAD and docker buildx imagetools inspect both report that as the OCI image index digest of the tag. The old tag resolves to the old pin 3889b425….
• The index covers linux amd64/arm64/arm/386/ppc64le/s390x, and the image config has GOLANG_VERSION=1.26.9.

Only the expected modules move.

• go list -m at head: x/crypto v0.57.0, x/net v0.60.0, x/sync v0.23.0, x/sys v0.48.0, x/term v0.46.0, x/text v0.42.0.
• x/term changes in go.sum only, as a transitive of crypto/sys; the body does not list it. Nothing else moves.

Reproduced locally (macOS, GOTOOLCHAIN=local with go1.26.9 at head and go1.26.6 at base, GOWORK=off, no -race). govulncheck v1.1.4 was built by me with the matching toolchain each time:

• head: go mod tidy leaves no diff. go build ./... and go vet ./... are OK.
• head: govulncheck on the root module exits 0 (0 vulnerabilities affecting the code; 1 in a required module that is not called). On tests/e2e it exits 0.
• base: govulncheck on the root module exits 3 with 12 vulnerabilities (GO-2026-6599 … 6617), all fixed in net/http go1.26.9 and/or x/net v0.60.0. So the bump is what clears them.

CI at this SHA:

• 22 SUCCESS and Integration Tests in progress.
• Security Scanning is FAILURE, but only on the npm audit (frontend) step; its govulncheck step passes. On main (e5baaabd, run 37905609950) both steps fail.
• The npm audit failure is pre-existing frontend debt, outside this Go-only PR, and is addressed by fix(deps): bump handlebars to 4.7.10 to clear npm audit critical #687 (handlebars 4.7.10).
• This PR cannot have a green Security Scanning job until fix(deps): bump handlebars to 4.7.10 to clear npm audit critical #687 lands, so the merge order or rerun is the lead's call.

Not verified: the Docker image build and shipped-image scan; I did not run Docker. CI covers them.

[cristim]

Independent delta review: APPROVE at 42691ded3f83d68c1cce65df6f9f01322ef4f164

Reviewer: archera-quotes-codex. Previous approved head: 8f4dd820 (comment above).

The delta is one commit, 42691ded (parent 8f4dd820), and it changes only frontend/package-lock.json. It is a cherry-pick of #687's 1a4616ed.

• git patch-id --stable is identical for both commits (4d11bad5…). The resulting frontend/package-lock.json blob is identical too (49b22149…).
• git diff 8f4dd820 42691ded outside that file is empty. The Go changes I approved are unchanged.
• The lock entry changes handlebars 4.7.9 -> 4.7.10.
  • Its integrity matches the npm registry's dist.integrity for 4.7.10.
  • handlebars 4.7.10 declares minimist ^1.2.8, and the lock already resolves minimist 1.2.8.

Reproduced with npm audit --package-lock-only --audit-level=high on the committed package.json and lock in a scratch dir (no install):

• 8f4dd820: exit 1. The audit reports 1 critical (handlebars 4.0.0-4.7.9) and 20 moderate.
• 42691ded: exit 0, with 20 moderate. These sit below the high level CI audits at and are pre-existing.

The Go evidence from the 8f4dd820 review still applies, because no Go file, go.mod, Dockerfile or workflow changed: govulncheck exits 0 at head and 3 at base, and build, vet and tidy are clean.

CI at 42691ded: still queued or in progress when I checked, including Security Scanning. The merge needs it green.

Note for #687: it carries the same patch on its own branch, so it becomes redundant once #693 merges.