fix: bump Go version from 1.26.4 to 1.26.5 (backport 2.34) - #27158
Conversation
8a85481 to
d577a68
Compare
Go 1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, addressing CVE-2026-39822 and CVE-2026-42505 flagged by IronBank scans. Ref: ENT-130
d577a68 to
b863f88
Compare
Shellcheck ≥0.9.0 (Ubuntu 26.04) flags the dead code after the if/else block as SC2317. Both branches called exit 0, making everything after line 32 unreachable. Cherry-pick the clean version from main that simply prints DEPLOY/NOOP without the dead code.
CI Update
|
|
/coder-agents-review |
|
Chat: Review posted | View chat Review history
deep-review v0.9.0 | Round 1 | Last posted: Round 1, 1 findings (1 P2), COMMENT. Review Finding inventoryFinding inventory: PR #27158Findings
Contested and acknowledged(none this round) Round logRound 1Netero-only gate passed (P3-and-below). Panel: Bisky, Hisoka, Mafu-san, Mafuuu, Pariston, Gon, Leorio, Kite, Komugi, Zoro (+ Netero first pass). Reviewed against db643c8..4527417. About deep-reviewCRF = Coder Review Finding (P0-P4, Nit, Note)
|
![coder-agents-review[bot]](https://avatars.githubusercontent.com/in/3454270?s=60&v=4){kind=small}
There was a problem hiding this comment.
The toolchain half of this backport is clean and complete. All four Go pins move together (go.mod, mise.toml, mise.lock, and the setup-go action default), no stray 1.26.4 survives in tracked files, and the mise.lock checksums were verified against the official go.dev manifest for every platform. The CVE-to-package mapping in the description checks out against the go1.26.5 release notes. As Hisoka put it: "I came to fight and found a version bump asleep in a chair. I poked it anyway."
Severity count: 1 P2, 1 Nit. One inline comment below.
On CI: three checks are red (build_image (nix), UI Review, UI Tests). None are caused by this diff. There are no site/ changes, so UI Review and UI Tests cannot regress from it. The nix job runs nix build .#dev_image, which is a buildNixShellImage over devShells.default; it bundles the unstablePkgs.go_1_26 package but never compiles the coder binary and never reads the go directive in go.mod, so a raised language floor cannot break it. The derivations that do compile Go (buildFat) are not built by this job, and this PR touches neither flake.nix nor flake.lock, so the dev_image inputs are unchanged and its hermetic result is identical before and after this PR. The red checks are pre-existing or infra; please confirm before relying on green CI, but they are not the bump's fault. (Note: an early panel reviewer flagged a P1 nix break here on the assumption that dev_image compiles against go.mod; that assumption was refuted on inspection.)
Nit (writing): the PR description uses emdashes (U+2014) in the CVE lines ("CVE-2026-39822 — os package"). House writing rules ban emdash/endash in authored text including PR descriptions. Replace with a colon or comma.
Recommend addressing the scope-transparency comment before merge; the change itself is sound.
🤖 This review was automatically generated with Coder Agents.
## Summary Bump Go toolchain from 1.26.4 to 1.26.5. Go 1.26.5 ([released 2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes security fixes addressing: - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) — `os` package - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) — `crypto/tls` package These were flagged by the IronBank scan of `coder/coder-enterprise/coder-service-2:2.34.5`. ## Changes - `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor) - `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is what actually compiles the scanned artifact and clears the CVEs) ## Related - #27159 — backport to `release/2.35` - #27158 — backport to `release/2.34` Linear: ENT-129
## Summary Backport Go toolchain bump from 1.26.4 to 1.26.5 to `release/2.35`. Go 1.26.5 ([released 2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes security fixes addressing: - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) — `os` package - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) — `crypto/tls` package These were flagged by the IronBank scan of `coder/coder-enterprise/coder-service-2:2.34.5`. ## Changes - `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor) - `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is what actually compiles the scanned artifact and clears the CVEs) ## Related - #27157 — original bump on `main` - #27158 — backport to `release/2.34` Linear: ENT-128
This is reproducible. My best guess is that we need to adjust the version of google-chrome-stable first. |
`nix develop` and `nix-shell` were broken because the `nixos-24.11` `google-chrome` derivation still pointed at Chrome 138, and Google no longer serves that versioned `.deb`. Update the flake's main `nixpkgs` input to `nixos-25.05` so the shell resolves a current Chrome package again. Pin `protoc 23.4` explicitly from the upstream protobuf release archives. This keeps the local Nix shell aligned with `mise.toml` and the CI/release codegen toolchain.
Follow-up to #26584. After the nixpkgs 25.05 update, the default go-migrate package panics at startup due to its Snowflake driver before Postgres commands can run. Coder only uses the migrate CLI for migration creation and local Postgres migrations, so override the build tags to include only the Postgres driver.
Nix
|
3 participants
Summary
Backport Go toolchain bump from 1.26.4 to 1.26.5 to
release/2.34.Go 1.26.5 (released 2026-07-07) includes security fixes to the
crypto/tlsandospackages, addressing:ospackagecrypto/tlspackageThese were flagged by the IronBank scan of
coder/coder-enterprise/coder-service-2:2.34.5.Main PR: #27157
Changes
go.mod:go 1.26.4togo 1.26.5(language version floor)mise.toml/mise.lock: Go toolchain pin 1.26.4 to 1.26.5 (this is what actually compiles the scanned artifact).github/actions/setup-go/action.yaml: default Go version 1.26.4 to 1.26.5scripts/should_deploy.sh: remove ~62 lines of unreachable dead code below an unconditionalif/elsethat exits in both branches; cherry-picked frommainto clear a shellcheck SC2317 warning on the Ubuntu 26.04 CI runnerNix flake fix cherry-picks
Two commits were cherry-picked from
mainto fix thebuild_image (nix)CI job onrelease/2.34:fccb238ec(fix: upgrade nixpkgs to 25.05 and pin protoc 23.4 #26584): Upgrade nixpkgs from 24.11 to 25.05, pinprotobuf_23_4. Fixes a build failure caused by Google removinggoogle-chrome-stable_138.0.7204.49-1_amd64.debfrom its CDN (Chrome 138 was end-of-lifed), which broke the nixpkgs 24.11google-chromederivation.ff71c1e82(fix(flake.nix): build go-migrate with only postgres driver #26643): Buildgo-migratewith only the postgres driver. Fixes a Snowflake driver compilation failure under the updated nixpkgs.These are already on
mainand have been cherry-picked torelease/2.34(via the base branch merge). Local validation confirmed the nix build succeeds with these patches applied.Note on
should_deploy.shThe
should_deploy.shcleanup is behavior-preserving. The existingif/elsealready exits withDEPLOY(main) orNOOP(any other branch) in both branches, making all code below it unreachable. The old release-branch deploy logic was already disabled by the short-circuit added earlier. This commit removes the dead code and was cherry-picked frommainto fix a shellcheck SC2317 (unreachable code) warning that started failing on the Ubuntu 26.04 runner.Linear: ENT-130