security: Go 1.26.5 builder + apt upgrade the release stage (15 CVEs) - #108
Merged
Conversation
Trivy on ghcr.io/nudgebee/forager:main-cca8173 shows 2 CRITICAL / 4 HIGH / 9 MEDIUM fixable: - 13 are stale debian packages in the pinned bookworm-slim release stage (libgnutls30 x11 incl. the 2 CRITICALs, libgcrypt20, liblzma5) — the digest snapshot drifts behind bookworm security releases and nothing re-upgraded it. Add apt-get upgrade behind a committed OS_PKG_EPOCH cache-bust (same pattern as the nudgebee service images). - 2 are the Go 1.26.4 stdlib pair (CVE-2026-39822 HIGH os.Root symlink traversal / CVE-2026-42505 crypto/tls ECH) in the forager binary. Pin the builder to golang:1.26.5-bookworm (digest) with GOTOOLCHAIN=local. Residual after this is the bookworm NOFIX floor only (no upstream fix published; shrinks via the same upgrade on rebuilds as debian publishes).
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go base image in the Dockerfile to version 1.26.5 to address security vulnerabilities and introduces an OS package upgrade step to patch base packages in the release stage. Feedback is provided to set the DEBIAN_FRONTEND environment variable to noninteractive and run apt-get clean to prevent interactive prompts and reduce the final image size.
CI's vuln job resolves its Go toolchain from go.mod (setup-go go-version-file), so govulncheck was analyzing with the 1.25.11 stdlib and flagging the crypto/tls CVE fixed in 1.25.12. The Docker builder already compiles with 1.26.5; this aligns the analysis toolchain onto a patched stdlib as well.
blue4209211
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Trivy on
ghcr.io/nudgebee/forager:main-cca8173(CI scan run nudgebee/nudgebee 29551177314) shows 2 CRITICAL / 4 HIGH / 9 MEDIUM fixable:debian:bookworm-slimrelease stage — digest snapshot drifted behind bookworm security releasesapt-get upgradebehind a committedOS_PKG_EPOCHcache-bust (same pattern as the nudgebee service images)golang:1.26.5-bookworm(digest-pinned) +GOTOOLCHAIN=localResidual after this: the bookworm NOFIX floor only (no upstream fix published; it shrinks on rebuilds as debian publishes fixes, via the same upgrade layer).
Note: dependabot keeps bumping the
golang:1.26floating-tag digest — the explicit1.26.5pin supersedes that for the toolchain; dependabot will track1.26.5-bookwormdigests from here.Type of change
How Has This Been Tested?
result.json, nudgebee/nudgebee run 29551177314); Dockerfile changes only, release binary and Oracle Instant Client handling untouched; CI build validates.Checklist