From 67889bc97add3f8d7bb8874cc3eec84f4ac7fc46 Mon Sep 17 00:00:00 2001 From: Firas Ghanmi Date: Wed, 24 Jun 2026 13:50:25 +0200 Subject: [PATCH 1/3] fix cve-2026-42499: Upgrade Go to 1.26.3 Signed-off-by: Firas Ghanmi --- .tool-versions | 2 +- Dockerfile | 2 +- Dockerfile.dist | 2 +- go.mod | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.tool-versions b/.tool-versions index 8dc011fd4..8fb890341 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1 +1 @@ -golang 1.25.9 +golang 1.26.3 diff --git a/Dockerfile b/Dockerfile index 532303f23..1781cfb75 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ ## Build -FROM docker.io/library/golang:1.25.9 AS build +FROM docker.io/library/golang:1.26.3 AS build ARG TARGETOS ARG TARGETARCH diff --git a/Dockerfile.dist b/Dockerfile.dist index 5b3fecc63..dc16cc54d 100644 --- a/Dockerfile.dist +++ b/Dockerfile.dist @@ -16,7 +16,7 @@ ## Build -FROM registry.access.redhat.com/ubi9/go-toolset:1.25.9@sha256:90a36bc2013b3fcb28e2a4b082c9b895d7c2c679e58b95aed9721970f3339d0e AS build +FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1781757851@sha256:1503a8227c00a1934e3c1a4a88e0be785786a2d9e2f62a9334e75ff2fadca2fe AS build ARG TARGETOS ARG TARGETARCH diff --git a/go.mod b/go.mod index 01fcd4a7d..6f6d7cfed 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli -go 1.25.9 +go 1.26.3 require ( cuelang.org/go v0.16.0 From 99d9fa13c5e9477c1aa3c21d405cac0704b49b09 Mon Sep 17 00:00:00 2001 From: Firas Ghanmi Date: Wed, 24 Jun 2026 15:07:28 +0200 Subject: [PATCH 2/3] fix cve-2026-42499: fix tag, tests go.mod Signed-off-by: Firas Ghanmi --- Dockerfile.dist | 2 +- acceptance/go.mod | 2 +- tools/go.mod | 2 +- tools/kubectl/go.mod | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile.dist b/Dockerfile.dist index dc16cc54d..6b7fa7f4b 100644 --- a/Dockerfile.dist +++ b/Dockerfile.dist @@ -16,7 +16,7 @@ ## Build -FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1781757851@sha256:1503a8227c00a1934e3c1a4a88e0be785786a2d9e2f62a9334e75ff2fadca2fe AS build +FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3-1781757851@sha256:1503a8227c00a1934e3c1a4a88e0be785786a2d9e2f62a9334e75ff2fadca2fe AS build ARG TARGETOS ARG TARGETARCH diff --git a/acceptance/go.mod b/acceptance/go.mod index 0e63ef4bf..ac69b0811 100644 --- a/acceptance/go.mod +++ b/acceptance/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/acceptance -go 1.25.9 +go 1.26.3 require ( cuelang.org/go v0.16.0 diff --git a/tools/go.mod b/tools/go.mod index ee400e020..59427cb23 100644 --- a/tools/go.mod +++ b/tools/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/tools -go 1.25.9 +go 1.26.3 require ( github.com/daixiang0/gci v0.13.7 diff --git a/tools/kubectl/go.mod b/tools/kubectl/go.mod index cec99f1e8..c9c536801 100644 --- a/tools/kubectl/go.mod +++ b/tools/kubectl/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/tools/kubectl -go 1.25.9 +go 1.26.3 require k8s.io/kubernetes v1.34.2 From 19d81e93f27560b2a9bc98b0a4cbeea2cacc9b58 Mon Sep 17 00:00:00 2001 From: Firas Ghanmi Date: Fri, 26 Jun 2026 00:19:48 +0200 Subject: [PATCH 3/3] update Dockerfile.dist Signed-off-by: Firas Ghanmi --- Dockerfile.dist | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.dist b/Dockerfile.dist index 6b7fa7f4b..4ee331585 100644 --- a/Dockerfile.dist +++ b/Dockerfile.dist @@ -16,7 +16,7 @@ ## Build -FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3-1781757851@sha256:1503a8227c00a1934e3c1a4a88e0be785786a2d9e2f62a9334e75ff2fadca2fe AS build +FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3-1781757851@sha256:17c888d75753f128f6cbdc5587932c3abd2632ca8e0931aa27b9a60c7a75ac62 AS build ARG TARGETOS ARG TARGETARCH