Skip to content

fix: bump extras/dagger Go toolchain for GO-2026-6617-stdlib #3643

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
chainloop-platform wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Draft

fix: bump extras/dagger Go toolchain for GO-2026-6617-stdlib #3643

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion extras/dagger/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module main

go 1.26.1
go 1.26.9

@migmartri migmartri Oct 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1.26.8 is the max the module supports, double check wether that's enough to fix the vuln

@migmartri migmartri Oct 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1.26.8 is not enough. The Go vulnerability database (GO-2026-6617, CVE-2026-97032) lists the stdlib fix in go1.26.9 (and go1.27.2 on the 1.27 line). The affected range is < 1.26.9. A go 1.26.8 directive would therefore not fix it. Scanners that read the go directive would still flag it, so the change would not even hide the finding.

The directive also does not choose the stdlib that the module runs with. The go line is only a minimum. The module is compiled inside the Dagger engine with the Go SDK image bundled into that engine release. Dagger v0.21.10 (the newest release, pinned in lint.yml and dagger.json) bundles golang:1.26-alpine as it was at build time, which is Go 1.26.8. The SDK image sets GOTOOLCHAIN=auto, but Dagger codegen (also built with 1.26.8) rejects the module before a newer toolchain could be fetched: bootstrap package: existing go.mod has unsupported version 1.26.9 (highest supported version is 1.26.8). That is the lint-dagger-module failure. So the built module uses 1.26.8 stdlib now, and it will keep using it with either directive until Dagger ships a newer engine.

Real exposure is low. The bug is an HTTP/2 server crash (an HPACK encoder race when handling SETTINGS). This module is a short-lived Dagger function that acts as a client of the engine. It does not serve HTTP/2 to untrusted clients. The main module is already on go 1.27.2, which is fixed.

Options:

  1. Wait for a Dagger release built with Go >= 1.26.9 (none is out yet; v0.21.10 is the latest). Then bump DAGGER_VERSION, engineVersion and the go directive together. Keep this PR open, or close it and let the bot reopen it after that release.
  2. Close this PR and accept or suppress GO-2026-6617 for extras/dagger until then, because the vulnerable server path is not reachable.

A directive of 1.26.8 is not a useful middle ground. I pushed nothing.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill


require github.com/Khan/genqlient v0.8.1

Expand Down
Loading