From 3db051dfc5bcbe5c472e0f3f8af00b5a1413f727 Mon Sep 17 00:00:00 2001 From: Taleodor Claude Date: Sat, 11 Jul 2026 02:01:00 +0000 Subject: [PATCH] fix(build): bump Dockerfile.exec Go toolchain to 1.26.5 The released zip binaries are built by Dockerfile.exec (via the onDemandPublishToAWS workflow), which still pinned golang:1.26.3-alpine3.23 - PR 31 updated only the main Dockerfile. As a result the published 26.07.1 binaries embed stdlib go1.26.3, which carries CVE-2026-42504 and CVE-2026-39822 (both HIGH) and trips consumers' vulnerability gates (rejected the rearm-watcher release). Align Dockerfile.exec to the same golang:1.26.5-alpine3.24 digest as the main Dockerfile. OSV reports zero stdlib vulns for 1.26.5. Verified by building Dockerfile.exec locally: the produced linux-amd64 binary embeds go1.26.5 and x/net v0.57.0. ReARM-Agentic-Session: cli-exec-builder-go-1783735254 ReARM-Agent: 62df357e-a3a4-4df5-82d4-049e629d1c6b Co-Authored-By: Claude Fable 5 --- Dockerfile.exec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.exec b/Dockerfile.exec index 751c8c0..70f5f91 100644 --- a/Dockerfile.exec +++ b/Dockerfile.exec @@ -1,4 +1,4 @@ -FROM golang:1.26.3-alpine3.23@sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d AS build-stage +FROM golang:1.26.5-alpine3.24@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS build-stage WORKDIR /build ENV CGO_ENABLED=0 COPY go.mod go.sum ./