From 2107ed97fcaf22270032300d0b98491feea0ba20 Mon Sep 17 00:00:00 2001 From: Distronode Date: Wed, 14 Oct 2026 20:45:54 -0400 Subject: [PATCH] security: Go toolchain 1.26.9, and the Docker builder on Go 1.27.2 govulncheck reports 12 published Go standard-library vulnerabilities as reachable from Calnode on the current toolchains (go1.26.6 in go.mod, which CI and the audit run on, and golang:1.27.1-alpine, which the image builds with). The Go vulnerability database lists every one as fixed in both 1.26.9 and 1.27.2: - GO-2026-6599, GO-2026-6600 (html/template) - GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617 (HTTP/2: net/http on 1.26, net/http/internal/http2 on 1.27) - GO-2026-6605, GO-2026-6609, GO-2026-6613 (net/http) - GO-2026-6607 (crypto/tls) - GO-2026-6608 (net/textproto) - go.mod: toolchain go1.26.9 (the go directive stays 1.26.0). - Dockerfile: golang:1.27.2-alpine (the line Dependabot moved it to). - CHANGELOG: a Security entry under Unreleased. go build ./..., go test ./... and govulncheck ./... pass on both go1.26.9 and go1.27.2 (govulncheck: no vulnerabilities found); gosec ./... is clean on go1.26.9. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 9 +++++++++ Dockerfile | 2 +- go.mod | 2 +- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index df6061e6..5d46c50a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,15 @@ exact tag (`ghcr.io/calnode/calnode:0.1.0`) if you need stability between upgrad key. Each invite gets a private reply address, and an answer only counts when Resend verified it came from that booking's booker. +### Security +- **Go toolchain 1.26.9, and the Docker image builds with Go 1.27.2.** Both close 12 + published Go standard-library vulnerabilities that `govulncheck` reports as reachable + from Calnode: GO-2026-6599 and GO-2026-6600 (`html/template`); GO-2026-6603, + GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 (HTTP/2 in `net/http`); + GO-2026-6605, GO-2026-6609 and GO-2026-6613 (`net/http`); GO-2026-6607 (`crypto/tls`); + and GO-2026-6608 (`net/textproto`). `go.mod` moves from `toolchain go1.26.6` and the + builder image from `golang:1.27.1-alpine`. No code or dependency change. + ## [0.10.1] - 2026-09-29 ### Added diff --git a/Dockerfile b/Dockerfile index ddcf81c2..f5318f7d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ COPY frontend/ . RUN pnpm build # ── Go build stage ───────────────────────────────────────────────────────────── -FROM golang:1.27.1-alpine AS builder +FROM golang:1.27.2-alpine AS builder RUN apk add --no-cache ca-certificates wget diff --git a/go.mod b/go.mod index 19cefd72..ef47e3fc 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/calnode/calnode go 1.26.0 -toolchain go1.26.6 +toolchain go1.26.9 require ( github.com/disintegration/imaging v1.6.2