From b5f878da45333681326b648670637d434ddf9ee4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 16:25:32 +0000 Subject: [PATCH 1/2] chore(deps): bump golang Bumps the routine-controller-images group in /controller with 1 update: golang. Updates `golang` from 1.27.2-bookworm to 1.27.3-bookworm --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.3-bookworm dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-controller-images ... Signed-off-by: dependabot[bot] --- controller/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/controller/Dockerfile b/controller/Dockerfile index 490c36fb..a86ac1c1 100644 --- a/controller/Dockerfile +++ b/controller/Dockerfile @@ -1,5 +1,5 @@ # syntax=docker/dockerfile:1.18@sha256:dabfc0969b935b2080555ace70ee69a5261af8a8f1b4df97b9e7fbcf6722eddf -FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 AS build +FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build ARG SOURCE_DATE_EPOCH=1786752000 RUN --mount=type=secret,id=ci_fleet_apt,target=/etc/apt/apt.conf.d/99-ci-fleet-cache \ rm -f /etc/apt/sources.list.d/debian.sources \ From e649820075554a5d6b85a50cfef46e6960f58ffa Mon Sep 17 00:00:00 2001 From: Nick Foster Date: Fri, 30 Oct 2026 11:10:25 -0500 Subject: [PATCH 2/2] docs(images): record reviewed Go 1.27.3 build input --- docs/MANAGED-IMAGES.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/MANAGED-IMAGES.md b/docs/MANAGED-IMAGES.md index 2fee4492..e70160e7 100644 --- a/docs/MANAGED-IMAGES.md +++ b/docs/MANAGED-IMAGES.md @@ -141,7 +141,11 @@ host resize, SDK upgrade or containerd socket access is required by this protoco Base-image and runner selections updated on 2026-10-12 from official upstream endpoints. The signed Debian snapshots were reviewed on 2026-10-12. Docker package pins retain their 2026-08-16 review: -The Go build image was updated to 1.27.2 on 2026-10-13. Docker Hub tag metadata confirms the pinned multi-architecture manifest digest below, including amd64 and arm64 variants. +The Go build image was updated to 1.27.2 on 2026-10-13. + +The Go build image was updated to 1.27.3 on 2026-10-30. This patch fixes +`crypto/x509` security issues. The reviewed registry manifest includes Linux +amd64 and arm64. The controller's module language version remains 1.26.3. Runner Buildx 0.32.1 package hashes were checked against the official Docker package index on 2026-10-15 for amd64 and arm64. The existing Docker CLI and @@ -150,7 +154,7 @@ Compose selections are unchanged. | Input | Immutable selection | Evidence | | --- | --- | --- | | Debian 13.7 slim, both managed images | `sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f` | Docker Hub registry manifest for `library/debian:13.7-slim` | -| Go 1.27.2 Bookworm build image | `sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61` | Docker Hub registry manifest for `library/golang:1.27.2-bookworm` | +| Go 1.27.3 Bookworm build image | `sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5` | Docker Hub registry manifest for `library/golang:1.27.3-bookworm`; [upstream patch notes](https://go.dev/doc/devel/release#go1.27.3) | | Debian packages | signed snapshot `20261012T000000Z` | `snapshot.debian.org/archive/debian/20261012T000000Z/dists/trixie/InRelease` | | Build timestamps | `SOURCE_DATE_EPOCH=1786752000` | BuildKit reproducible-build timestamp input declared in every stage | | Docker CLI 29.7.2 amd64 / arm64 | exact package version and SHA-256 `3d1a00d1549f7539606252b1e2b88ae2a0c855e02e5fa92ad962c8a118d7f6ad` / `6bb694f01789b9869e99e34df3492104c0150d12df93192034db5f88cf0f7c8c` | official Docker Debian `trixie` package index |