fix: bump Go version from 1.26.4 to 1.26.5 (backport 2.35) - #27159
Conversation
f1e9f1a to
fa4829f
Compare
Go 1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, addressing CVE-2026-39822 and CVE-2026-42505 flagged by IronBank scans. Ref: ENT-128
fa4829f to
aa92b45
Compare
|
/coder-agents-review |
|
Chat: Review posted | View chat Review history
deep-review v0.9.0 | Round 1 | Last posted: Round 1, 1 findings (1 Note), COMMENT. Review Finding inventoryFinding inventory - PR #27159Findings
Round logRound 1Netero (clean, no findings) + 10-reviewer panel (bisky, hisoka, mafu-san, mafuuu, pariston, gon, leorio, komugi, kurapika, knov). No code defects. All five changed mise.lock checksums verified byte-for-byte against About deep-reviewCRF = Coder Review Finding (P0-P4, Nit, Note)
|
![coder-agents-review[bot]](https://avatars.githubusercontent.com/in/3454270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Clean, well-scoped backport. The Go toolchain moves 1.26.4 to 1.26.5 in go.mod, mise.toml, and mise.lock, and nothing else. Severity count: 0 P0-P2, 0 P3-P4, 2 nits (both on the PR text, not the code), plus verification notes.
The one security-relevant surface here is the download-integrity pins, and they check out. All five changed mise.lock checksums were verified byte-for-byte against the official Go release manifest at go.dev/dl for go1.26.5 (linux-amd64, linux-arm64, darwin-amd64, darwin-arm64, windows-amd64). The baseline and musl variants correctly reuse the amd64 checksum because they resolve to the same tarball. check_go_versions.sh passes, a repo-wide grep for 1.26.4 returns zero stale references, there is no toolchain directive or hardcoded Go version in CI or Dockerfiles to fall out of sync, and flake.nix is correctly left untouched since it pins only major.minor. The CVE and release-date claims match the go.dev release notes.
Hisoka summed up the panel's experience: "I came looking for a fight." There wasn't one.
Two minor points on the PR description itself (not the diff, so neither blocks):
- The two CVE bullet lines use an em dash (U+2014). The repo bans emdash in code, comments, and docs, and make lint/emdash enforces it on tracked files. The PR body is not linted, but it is the exact house-style class the project keeps correcting. A colon reads fine: "CVE-2026-39822: os package".
- The "## Changes" section lists only go.mod and omits mise.toml and mise.lock. For a security backport, the lockfile checksum change is the part a reviewer most needs to trust, so it is worth naming all three files.
Neither is required before merge.
This review was generated by Coder Agents.
🤖 This review was automatically generated with Coder Agents.
## Summary Bump Go toolchain from 1.26.4 to 1.26.5. Go 1.26.5 ([released 2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes security fixes addressing: - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) — `os` package - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) — `crypto/tls` package These were flagged by the IronBank scan of `coder/coder-enterprise/coder-service-2:2.34.5`. ## Changes - `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor) - `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is what actually compiles the scanned artifact and clears the CVEs) ## Related - #27159 — backport to `release/2.35` - #27158 — backport to `release/2.34` Linear: ENT-129
2 participants
Summary
Backport Go toolchain bump from 1.26.4 to 1.26.5 to
release/2.35.Go 1.26.5 (released 2026-07-07) includes security fixes addressing:
ospackagecrypto/tlspackageThese were flagged by the IronBank scan of
coder/coder-enterprise/coder-service-2:2.34.5.Changes
go.mod:go 1.26.4togo 1.26.5(language version floor)mise.toml/mise.lock: Go toolchain pin 1.26.4 to 1.26.5 (this is what actually compiles the scanned artifact and clears the CVEs)Related
mainrelease/2.34Linear: ENT-128