From 8f4dd820d02e074accea6ea06fb7269e49dd6080 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 9 Oct 2026 10:46:57 +0200 Subject: [PATCH 1/2] fix(deps): bump Go to 1.26.9 and x/net to v0.60.0 for govulncheck advisories - Go 1.26.6 -> 1.26.9 in go.mod, go.work, the three Dockerfiles (new index digest for golang:1.26.9-alpine3.24), the CI GO_VERSION and the docs that quote it. Clears the net/http and other stdlib advisories fixed in 1.26.9 (GO-2026-6599, 6600, 6605, 6607, 6608, 6611, 6612, 6613). - golang.org/x/net v0.58.0 -> v0.60.0 via go get + tidy (GO-2026-6603, 6612, 6617); tidy also moved x/crypto, x/sync, x/sys and x/text to their minimum-compatible newer releases. - Fixes the failing "Security Scanning" govulncheck step and the shipped image Go advisory scan on main. --- .github/workflows/README.md | 2 +- .github/workflows/ci.yml | 4 ++-- CONTRIBUTING.md | 4 ++-- Dockerfile | 4 ++-- Dockerfile.dev | 4 ++-- Dockerfile.test | 2 +- docs/DEPLOYMENT.md | 2 +- docs/DEVELOPMENT.md | 2 +- go.mod | 12 ++++++------ go.sum | 24 ++++++++++++------------ go.work | 2 +- 11 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 176cb9451..022eb0813 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -52,7 +52,7 @@ Runs comprehensive quality checks on every pull request and push to main branch. ### Required Variables -- `GO_VERSION` (default: 1.26.6) +- `GO_VERSION` (default: 1.26.9) ### Example diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c7a917abd..41fccbf30 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ # Required GitHub Secrets: None (all checks run without cloud credentials) # # Required GitHub Variables: -# - GO_VERSION: Go version to use (default: 1.26.6) +# - GO_VERSION: Go version to use (default: 1.26.9) # # Triggered by: # - Pull requests to main/develop @@ -26,7 +26,7 @@ on: workflow_dispatch: env: - GO_VERSION: '1.26.6' + GO_VERSION: '1.26.9' DOCKER_BUILDKIT: 1 COMPOSE_DOCKER_CLI_BUILD: 1 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 89cb7c2a0..ae959869c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -48,7 +48,7 @@ By participating in this project, you agree to maintain a respectful and inclusi ### Prerequisites -- Go 1.26.6 or later (the floor set by the `go` directive in `go.mod`) +- Go 1.26.9 or later (the floor set by the `go` directive in `go.mod`) - Node.js and npm for the `frontend/` dashboard - Terraform, when changing deployment definitions - AWS/Azure/GCP credentials for integration testing @@ -88,7 +88,7 @@ from a copy of the committed `go.work` and append your active worktrees: // go.work.local -- gitignored, developer-local // Keep this `go` line at or above the modules' own directive, otherwise the // workspace is rejected. Copy it from the committed go.work. -go 1.26.6 +go 1.26.9 use ( . diff --git a/Dockerfile b/Dockerfile index 69ebb2bba..02a16a1cd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,10 +12,10 @@ ARG TARGETOS=linux # Build stage # Image pinned to a SHA256 digest for reproducible builds — a registry # tag mutation (Docker Hub allows re-tagging) cannot poison this build. -# To refresh: `docker buildx imagetools inspect golang:1.26.6-alpine3.24` +# To refresh: `docker buildx imagetools inspect golang:1.26.9-alpine3.24` # (or use the Docker Hub API tags endpoint) and update the digest below. # A Renovate / Dependabot config can automate this if desired. -FROM --platform=$BUILDPLATFORM golang:1.26.6-alpine3.24@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS builder +FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine3.24@sha256:cdfd4fe2da6b225d8b40c6b7a105736e548e83ff56d5d8f9394446eeb5eb84e0 AS builder # Re-declare args for use in this stage ARG TARGETARCH diff --git a/Dockerfile.dev b/Dockerfile.dev index daa954b1b..7c8bbcd34 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,11 +1,11 @@ # Development Dockerfile with hot reload using Air # Image pinned to a SHA256 digest for reproducible builds; a registry # tag mutation (Docker Hub allows re-tagging) cannot poison this build. -# To refresh: `docker buildx imagetools inspect golang:1.26.6-alpine3.24` +# To refresh: `docker buildx imagetools inspect golang:1.26.9-alpine3.24` # (or use the Docker Hub API tags endpoint) and update the digest below. # A Renovate / Dependabot config can automate this if desired. # Keep this digest in sync with the builder stage in Dockerfile. -FROM golang:1.26.6-alpine3.24@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS development +FROM golang:1.26.9-alpine3.24@sha256:cdfd4fe2da6b225d8b40c6b7a105736e548e83ff56d5d8f9394446eeb5eb84e0 AS development # Install development tools and Air for hot reload RUN apk add --no-cache \ diff --git a/Dockerfile.test b/Dockerfile.test index d7560d01f..c9f7d4a41 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -5,7 +5,7 @@ # # Base image pinned by digest for the same supply-chain reasons as Dockerfile; # keep the digest in sync with the builder stage there. -FROM golang:1.26.6-alpine3.24@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 +FROM golang:1.26.9-alpine3.24@sha256:cdfd4fe2da6b225d8b40c6b7a105736e548e83ff56d5d8f9394446eeb5eb84e0 # Run the suite as a non-root user (trivy DS-0002). tests/e2e is a stdlib-only # module so no module downloads are needed; GOCACHE lives in the user's home, diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md index cabb92952..332e47841 100644 --- a/docs/DEPLOYMENT.md +++ b/docs/DEPLOYMENT.md @@ -56,7 +56,7 @@ Terraform automatically handles: Docker image build/push (via build module), fro - Docker with buildx support - Terraform >= 1.6.0 -- Go 1.26.6+ +- Go 1.26.9+ - Cloud CLI configured: `aws`, `az`, or `gcloud` --- diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md index 92a77ec4c..83454463c 100644 --- a/docs/DEVELOPMENT.md +++ b/docs/DEVELOPMENT.md @@ -3,7 +3,7 @@ ## Prerequisites - Docker and Docker Compose -- Go 1.26.6+ +- Go 1.26.9+ - Node.js and npm (for frontend development) - Make (optional, for convenience commands) diff --git a/go.mod b/go.mod index e76864cd5..1a4d8d623 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/cloud-commitments-platform -go 1.26.6 +go 1.26.9 require ( github.com/aws/aws-sdk-go-v2 v1.41.5 @@ -61,12 +61,12 @@ require ( go.opentelemetry.io/otel v1.45.0 // indirect go.opentelemetry.io/otel/metric v1.45.0 // indirect go.opentelemetry.io/otel/trace v1.45.0 // indirect - golang.org/x/crypto v0.56.0 - golang.org/x/net v0.58.0 // indirect + golang.org/x/crypto v0.57.0 + golang.org/x/net v0.60.0 // indirect golang.org/x/oauth2 v0.36.0 - golang.org/x/sync v0.22.0 - golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/sync v0.23.0 + golang.org/x/sys v0.48.0 // indirect + golang.org/x/text v0.42.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.274.0 google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect diff --git a/go.sum b/go.sum index c505451e3..93810e403 100644 --- a/go.sum +++ b/go.sum @@ -347,24 +347,24 @@ go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJj go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= -golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= -golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/go.work b/go.work index 3576cc0a0..fc44b1d4d 100644 --- a/go.work +++ b/go.work @@ -1,4 +1,4 @@ -go 1.26.6 +go 1.26.9 use ( . From 42691ded3f83d68c1cce65df6f9f01322ef4f164 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 9 Oct 2026 10:29:50 +0200 Subject: [PATCH 2/2] fix(deps): bump handlebars to 4.7.10 to clear npm audit critical - Lockfile-only update of the transitive dev dependency (pulled in by jest/istanbul-reports). Clears GHSA-xw65-4hp5-5hc7, GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f, which fail the CI "Security Scanning" job (npm audit --audit-level=high) on main. - The remaining sprintf-js moderate advisory does not trip the high gate and needs a breaking ts-jest change, so it is left alone. --- frontend/package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 7260ecfac..49b22149b 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -7022,13 +7022,13 @@ "license": "MIT" }, "node_modules/handlebars": { - "version": "4.7.9", - "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz", - "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==", + "version": "4.7.10", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.10.tgz", + "integrity": "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==", "dev": true, "license": "MIT", "dependencies": { - "minimist": "^1.2.5", + "minimist": "^1.2.8", "neo-async": "^2.6.2", "source-map": "^0.6.1", "wordwrap": "^1.0.0"