Skip to content

release v1.11.5 - #880

Merged
jan--f merged 1 commit into
masterfrom
bump-1.11.5
Oct 22, 2026
Merged

jan--f merged 1 commit into
masterfrom
bump-1.11.5

Conversation

@jan--f

@jan--f jan--f commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

No description provided.

Signed-off-by: Jan Fajerski <jfajersk@redhat.com>
Comment thread CHANGELOG.md
@@ -1,3 +1,8 @@
## 1.11.5 / 2026-10-21

* [SECURITY] Build with Go 1.27.3 to fix vulnerabilities in `net/http`, `net/textproto`, `crypto/tls` and `html/template`.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still see go 1.26.0 in

go 1.26.0

maybe we can/should bump that 1.26 instead?

(is 1.27.3 only used for the shipped build/in CI?)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This gets build with the prometheus golang-builder which has prometheus/golang-builder#408. So this should fix our images. It's what Prometheus 3.15.1 did as well.

Afaiu the go directive marks the minimum go version semantics the project needs.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, I meant that users that would rebuild their own binaries/images would not benefit from this.

It just the changelong entries that look a little bit vague, to me.

Let's not block on that.

Thanks.

@jan--f
jan--f merged commit 33662eb into master Oct 22, 2026
27 checks passed
@jan--f
jan--f deleted the bump-1.11.5 branch October 22, 2026 08:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants