Skip to content

security: Go 1.26.5 builder + apt upgrade the release stage (15 CVEs) #108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
blue4209211 merged 3 commits into from
Jul 17, 2026
Merged

security: Go 1.26.5 builder + apt upgrade the release stage (15 CVEs) #108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9ca2607
security: Go 1.26.5 builder + apt upgrade the release stage (15 CVEs)
mayankpande88 Jul 17, 2026
06c7ef9
chore: DEBIAN_FRONTEND=noninteractive + apt-get clean in release stag…
mayankpande88 Jul 17, 2026
99c89be
security: go directive 1.25.11 -> 1.25.12 (govulncheck toolchain)
mayankpande88 Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
FROM golang:1.26-bookworm@sha256:5d2b868674b57c9e48cdd39e891acce4196b6926ca6d11e9c270a8f85106203d AS build-stage
# golang 1.26.5: fixes the Go stdlib pair CVE-2026-39822 (HIGH, os.Root symlink
# traversal) / CVE-2026-42505 (crypto/tls ECH) that 1.26.4 builds carry.
FROM golang:1.26.5-bookworm@sha256:1ecb7edf62a0408027bd5729dfd6b1b8766e578e8df93995b225dfd0944eb651 AS build-stage
# Always compile with the base image's Go, never an auto-downloaded toolchain.
ENV GOTOOLCHAIN=local

WORKDIR /app

Expand Down Expand Up @@ -38,8 +42,21 @@ RUN chmod +x /app/nudgebee-forager

FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb AS release-stage

RUN apt-get update && apt-get install -y --no-install-recommends \
# apt-get upgrade patches the base packages to the latest bookworm security
# releases — the pinned digest snapshot drifts behind (Trivy flagged 13 fixable
# C/H/M: libgnutls30 incl. 2 CRITICAL, libgcrypt20, liblzma5).
# OS-package cache-bust: bumping OS_PKG_EPOCH (ISO week) changes this layer's
# cache key so a registry/build cache can't serve a stale package layer; bump it
# when a scan flags a stale package.
# DEBIAN_FRONTEND=noninteractive keeps upgraded packages from opening debconf
# prompts and hanging the non-TTY CI build; scoped via `export` so it does not
# persist into the image.
ARG OS_PKG_EPOCH=2026-W29
RUN echo "os-pkg-epoch: ${OS_PKG_EPOCH}" && \
export DEBIAN_FRONTEND=noninteractive && \
apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
ca-certificates libaio1 && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
Comment thread
mayankpande88 marked this conversation as resolved.

WORKDIR /app
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module nudgebee/forager

go 1.25.11
go 1.25.12

require (
cloud.google.com/go/auth v0.20.0
Expand Down
Loading