From 31247f4a72be0d655cbb3d454545e457339cc74d Mon Sep 17 00:00:00 2001 From: Gerard Louis Recinto Date: Wed, 21 Oct 2026 21:59:39 -0700 Subject: [PATCH] Bump Go to 1.26.10 and 1.27.3 to clear GO-2026-6809 --- .github/workflows/ci.yml | 2 +- CHANGELOG.md | 4 ++++ Dockerfile | 4 ++-- README.md | 4 ++-- adapters/cassandra/go.mod | 2 +- adapters/nats/go.mod | 2 +- adapters/redis/go.mod | 2 +- ai/go.mod | 2 +- bindings/Dockerfile.build | 2 +- deploy/k8s-gate/Dockerfile | 2 +- docker/Dockerfile.barrier | 2 +- docker/Dockerfile.nocov | 4 ++-- docker/Dockerfile.quickstart | 2 +- docs/AGENT_PROTOCOLS.md | 2 +- docs/GO_CORE_ENGINE.md | 2 +- go.mod | 2 +- go.work | 2 +- incfs/go.mod | 2 +- infs/go.mod | 2 +- jsondb/go.mod | 2 +- search/go.mod | 2 +- tools/httpserver/README.md | 2 +- 22 files changed, 28 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e77c6af19..edf605261 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: # below for why. # # Go version: the project pins one exact toolchain version in go.mod - # (currently 1.26.9, for CVE remediation, see CHANGELOG.md) rather than + # (currently 1.26.10, for CVE remediation, see CHANGELOG.md) rather than # supporting a range, so this matrix intentionally does not add a Go # version axis; `go-version-file: go.mod` picks up that pinned version on # every OS. diff --git a/CHANGELOG.md b/CHANGELOG.md index 5b10a38a0..625c3de7c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## Unreleased + +- Go is bumped to 1.26.10 and 1.27.3, which clears GO-2026-6809 in `crypto/x509` that the govulncheck and Trivy image scans now report against 1.26.9 and 1.27.2. + ## v5.11.1 - The release build for the Linux and Windows libraries pinned Go 1.26.8 and failed against the Go 1.26.9 requirement, so the v5.11.0 packages were not built. This release fixes the pin. It carries everything listed under v5.11.0. diff --git a/Dockerfile b/Dockerfile index 08d6b1d6a..26e546e96 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ # ============================================================================== # Stage 1: Builder # ============================================================================== -FROM golang:1.27.2-alpine AS builder +FROM golang:1.27.3-alpine AS builder # Install build dependencies, CA certificates, and tzdata RUN apk add --no-cache ca-certificates tzdata @@ -42,7 +42,7 @@ RUN mkdir -p /out/var/lib/sop && chown -R 65532:65532 /out/var/lib/sop # ============================================================================== # Stage 2: Integration Test Runner (Optional Target: --target test) # ============================================================================== -FROM golang:1.27.2-alpine AS test +FROM golang:1.27.3-alpine AS test RUN apk add --no-cache redis WORKDIR /app COPY --from=builder /src /app diff --git a/README.md b/README.md index 98955ca65..b2e6cc1c9 100644 --- a/README.md +++ b/README.md @@ -67,7 +67,7 @@ go run github.com/sharedcode/joltrin/v5/examples/agent_team@latest # Jira, go run github.com/sharedcode/joltrin/v5/examples/quickstart@latest # the embedded B-Tree that holds the state ``` -No clone needed, only Go 1.26.9 or newer. An older Go downloads 1.26.9 on its own. The first run downloads the modules and compiles, which took about 10 seconds on a MacBook Air, and later runs are quick. To read the code, or to run `./scripts/demo.sh --memory`, clone the repo. +No clone needed, only Go 1.26.10 or newer. An older Go downloads 1.26.10 on its own. The first run downloads the modules and compiles, which took about 10 seconds on a MacBook Air, and later runs are quick. To read the code, or to run `./scripts/demo.sh --memory`, clone the repo. Or skip the install. These run in your browser with no backend: @@ -124,7 +124,7 @@ go install github.com/sharedcode/joltrin/v5/cmd/sop-mcp-server@latest "$(go env GOPATH)/bin/sop-mcp-server" setup --apply ``` -The first `go install` downloads the Go modules, which took about 15 seconds on a MacBook Air. If your Go is older than 1.26.9, Go also downloads that toolchain once, about 240 MB. +The first `go install` downloads the Go modules, which took about 15 seconds on a MacBook Air. If your Go is older than 1.26.10, Go also downloads that toolchain once, about 240 MB. diff --git a/adapters/cassandra/go.mod b/adapters/cassandra/go.mod index 7d1b0a6b6..2e992e926 100644 --- a/adapters/cassandra/go.mod +++ b/adapters/cassandra/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/adapters/cassandra -go 1.26.9 +go 1.26.10 require ( github.com/gocql/gocql v1.7.0 diff --git a/adapters/nats/go.mod b/adapters/nats/go.mod index 075fce8a7..60bc55f47 100644 --- a/adapters/nats/go.mod +++ b/adapters/nats/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/adapters/nats -go 1.26.9 +go 1.26.10 require ( github.com/nats-io/nats-server/v2 v2.15.1 diff --git a/adapters/redis/go.mod b/adapters/redis/go.mod index 8aca2b62c..b28b146b6 100644 --- a/adapters/redis/go.mod +++ b/adapters/redis/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/adapters/redis -go 1.26.9 +go 1.26.10 require github.com/redis/go-redis/v9 v9.23.0 diff --git a/ai/go.mod b/ai/go.mod index 411bb2fe0..41e1b81da 100644 --- a/ai/go.mod +++ b/ai/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/ai -go 1.26.9 +go 1.26.10 require ( github.com/google/cel-go v0.30.0 diff --git a/bindings/Dockerfile.build b/bindings/Dockerfile.build index c726abf5a..1dad0cfd3 100644 --- a/bindings/Dockerfile.build +++ b/bindings/Dockerfile.build @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM golang:1.26.9 +FROM golang:1.26.10 # Install dependencies # mingw-w64 is needed for Windows builds if not using Zig for Windows (the script uses x86_64-w64-mingw32-gcc) diff --git a/deploy/k8s-gate/Dockerfile b/deploy/k8s-gate/Dockerfile index 7885d20bb..0ef9b8dc7 100644 --- a/deploy/k8s-gate/Dockerfile +++ b/deploy/k8s-gate/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 # Build from the repository root: docker build -f deploy/k8s-gate/Dockerfile . -FROM golang:1.27.2-alpine AS builder +FROM golang:1.27.3-alpine AS builder WORKDIR /src COPY . . RUN --mount=type=cache,target=/go/pkg/mod \ diff --git a/docker/Dockerfile.barrier b/docker/Dockerfile.barrier index 84d38c708..98004dbf7 100644 --- a/docker/Dockerfile.barrier +++ b/docker/Dockerfile.barrier @@ -7,7 +7,7 @@ # ============================================================================== # Stage 1: Builder # ============================================================================== -FROM golang:1.27.2-alpine AS builder +FROM golang:1.27.3-alpine AS builder WORKDIR /src diff --git a/docker/Dockerfile.nocov b/docker/Dockerfile.nocov index 3b0c3081a..1ecc6c5c7 100644 --- a/docker/Dockerfile.nocov +++ b/docker/Dockerfile.nocov @@ -3,7 +3,7 @@ # ============================================================================== # Stage 1: Builder # ============================================================================== -FROM golang:1.27.2-alpine AS builder +FROM golang:1.27.3-alpine AS builder WORKDIR /src @@ -29,7 +29,7 @@ COPY . . # ============================================================================== # Stage 2: Integration Test Runner (No Coverage) # ============================================================================== -FROM golang:1.27.2-alpine AS build-and-test +FROM golang:1.27.3-alpine AS build-and-test # Install Redis server for Alpine RUN apk add --no-cache redis diff --git a/docker/Dockerfile.quickstart b/docker/Dockerfile.quickstart index 47cda9839..063119ac3 100644 --- a/docker/Dockerfile.quickstart +++ b/docker/Dockerfile.quickstart @@ -6,7 +6,7 @@ # ============================================================================== # Stage 1: Builder # ============================================================================== -FROM golang:1.27.2-alpine AS builder +FROM golang:1.27.3-alpine AS builder WORKDIR /src diff --git a/docs/AGENT_PROTOCOLS.md b/docs/AGENT_PROTOCOLS.md index deb982cf4..6f30d4a9b 100644 --- a/docs/AGENT_PROTOCOLS.md +++ b/docs/AGENT_PROTOCOLS.md @@ -200,5 +200,5 @@ Exit codes are the same everywhere: 0 for success, 1 for a failure, and 2 for a - **A block you did not expect.** The result names the rule, the missing state and the steps that establish it. `sop-mcp-server check` shows the runbook's steps and what each needs. - **Memory is on but there are no lessons.** Lessons appear once a block has been recorded for the current runbook. A runbook that has changed starts fresh, and entries expire after 30 days. - **A call is refused for an id that is too long.** `trace_id`, `idempotency_key`, workflow and step names are limited to 256 bytes. -- **The first `go install` takes minutes.** It downloads the Go modules, and a Go older than 1.26.9 also downloads a toolchain. The prebuilt binary skips both: see the install command in the README. +- **The first `go install` takes minutes.** It downloads the Go modules, and a Go older than 1.26.10 also downloads a toolchain. The prebuilt binary skips both: see the install command in the README. - **Windows.** Use the `.exe` from the release page and run `setup --apply` from the folder you keep it in, because it registers that path. diff --git a/docs/GO_CORE_ENGINE.md b/docs/GO_CORE_ENGINE.md index ec8e59e3c..0d8d13495 100644 --- a/docs/GO_CORE_ENGINE.md +++ b/docs/GO_CORE_ENGINE.md @@ -340,7 +340,7 @@ SOP has all the bits required to be used like a golang map but which, has the fe Requirements: * Storage Drive(s) or sub-system (paths) for Blobs. Can be **Local Disk** (for standalone/dev) or **Network Mounts** (NAS/S3/Cloud) for distributed clusters. * User that you will use for the process which has Read/Write permissions(e.g. - 0777) to the drive(s)/storage path(s) - * Golang that supports generics, SOP package (go.mod) currently is set to use 1.26.9 and higher + * Golang that supports generics, SOP package (go.mod) currently is set to use 1.26.10 and higher * (Optional) Redis - required only for distributed/cluster mode or if using Redis-backed caching. ## Sample Code diff --git a/go.mod b/go.mod index baa90706c..3a561831c 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/v5 -go 1.26.9 +go 1.26.10 require ( github.com/a2aproject/a2a-go v0.3.15 diff --git a/go.work b/go.work index f8e6d74f6..2baad0792 100644 --- a/go.work +++ b/go.work @@ -1,4 +1,4 @@ -go 1.26.9 +go 1.26.10 use ( . diff --git a/incfs/go.mod b/incfs/go.mod index ea8d3ab40..ceef026ca 100644 --- a/incfs/go.mod +++ b/incfs/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/incfs -go 1.26.9 +go 1.26.10 require ( github.com/sharedcode/joltrin/adapters/cassandra v0.1.0 diff --git a/infs/go.mod b/infs/go.mod index ee09d63bd..19e388000 100644 --- a/infs/go.mod +++ b/infs/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/infs -go 1.26.9 +go 1.26.10 require ( github.com/sharedcode/joltrin/adapters/redis v0.1.0 diff --git a/jsondb/go.mod b/jsondb/go.mod index a46277212..2109ff164 100644 --- a/jsondb/go.mod +++ b/jsondb/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/jsondb -go 1.26.9 +go 1.26.10 require ( github.com/google/uuid v1.6.0 diff --git a/search/go.mod b/search/go.mod index 2a19f57f5..f4f76e21a 100644 --- a/search/go.mod +++ b/search/go.mod @@ -1,6 +1,6 @@ module github.com/sharedcode/joltrin/search -go 1.26.9 +go 1.26.10 require ( github.com/sharedcode/joltrin/infs v0.1.0 diff --git a/tools/httpserver/README.md b/tools/httpserver/README.md index 47c31997f..8d0c31d0f 100644 --- a/tools/httpserver/README.md +++ b/tools/httpserver/README.md @@ -52,7 +52,7 @@ In a large-scale enterprise environment, the SOP Data Manager shines as a statel ## Usage ### Prerequisites -- Go 1.26.9+ installed. +- Go 1.26.10+ installed. - Run from the root of the `sop` repository so `go run ./tools/httpserver` resolves the module correctly. - Either: - an existing SOP database folder for single-database mode, or