Repository navigation
security - patch Go, CA and x/text/x/image advisories (23 Oct 2026) - #199
Merged
Merged
Conversation
Move Go 1.26.3 to 1.26.10 and rebuild the Alpine base images on the refreshed digests that carry ca-certificates 20261020-r0 (eMudhra CA, CVE-2026-111943). Refresh the APK pins and checksums the base images need, the postgres:18.4-alpine test digest, and bump golang.org/x/text to v0.41.0 and golang.org/x/image to v0.45.0 for the reachable high advisories govulncheck reports.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe pull request updates Go to 1.26.10, advances four Go module dependencies, refreshes pinned Alpine packages and image digests, and changes PostgreSQL 18.4 Alpine digests used by Compose and tests. ChangesGo toolchain and dependency versions
Base-image package pins and checksums
PostgreSQL image digest updates
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 8 files. (13 skipped: … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly summarises the security-focused dependency and Go updates, which are the main changes in the pull request. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 8 files. (13 skipped: 13 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
go.mod,gofmt.yml,tests.yml,build.mk,Dockerfile.builder,dockerfile-apiand thedocker-compose.ymlandapp.mktoolchain defaultsgolang:1.26.10-alpine3.23digestsha256:0525c952…andalpine:3.23digestsha256:21f3e19b…(Alpine 3.23.7, ca-certificates 20261020-r0);BASE_IMAGE_REVISION6 → 7checksums/*.sha256regenerated withgenerate-checksums.shmainalready failsdocker-compose.ymlBASE_IMAGE_VERSIONdefault1.26.3-alpine3.23-r4→1.26.10-alpine3.23-r7build.mkwas already on r6postgres:18.4-alpinedigest96d56f7f…→9a8afca5…in the compose file and Testcontainers helpersgolang.org/x/textv0.37.0 → v0.41.0golang.org/x/imagev0.41.0 → v0.45.0x/syncmoved to v0.22.0 andx/systo v0.47.0 asgo getrequired.Checks
go build ./...andgo vet ./...(Go 1.26.10): pass.go test ./...: every package without a database passes. The Postgres Testcontainers suites failed locally because Docker Desktop's published ports are broken (mapped port: "invalid port"). They also failed when rerun serially. Continuous Integration (CI) should run them.govulncheck ./...: the x/text and x/image findings are cleared. Two reachable findings remain.Follow-ups
golang.org/x/cryptov0.52.0: GO-2026-6354 and GO-2026-6355 (ssh channel denial of service) are fixed in v0.56.0. Severity is unrated, so this PR leaves them.CADDY_VERSION=2.10.2is frozen on Alpine 3.22.3 with ca-certificates 20250911. Onlycaddy:2-alpine(2.11.7) carries 20261020-r0, so moving Caddy is a minor-version decision.postgres:18.4-alpinehas not been rebuilt with the refreshed CA bundle. Refresh the digest again when it is.dockerfile-apican pull them.🤖 Generated with Claude Code
Summary by CodeRabbit