Skip to content

chore(deps): bump Go builder to 1.26.1 and update base images - #2151

Merged
Quang Nguyen (nddq) merged 1 commit into
mainfrom
chore/bump-base-images
Apr 3, 2026
Merged

chore(deps): bump Go builder to 1.26.1 and update base images#2151
Quang Nguyen (nddq) merged 1 commit into
mainfrom
chore/bump-base-images

Conversation

@nddq

@nddq Quang Nguyen (nddq) commented Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Description

Go 1.26.0 has 4 stdlib CVEs with fixes in 1.26.1 (CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27142). This PR bumps the Go builder images to 1.26.1 and updates all base image digests to latest.

Image digest updates:

  • oss/go/microsoft/golang 1.26.0 → 1.26.1 (azurelinux3.0, plain, windowsservercore-ltsc2022)
  • azurelinux/base/core:3.0 → latest digest
  • azurelinux/distroless/minimal:3.0 → latest digest
  • windows/nanoserver:ltsc2022 → latest digest
  • windows/servercore:ltsc2022 → latest digest
  • mirror/docker/library/ubuntu:24.04 → pinned by digest (was tag-only)

Also adds make bump-images (scripts/bump-images.sh) which:

  1. Checks for newer Go minor/patch versions from the registry and prompts the user to select which version to bump to
  2. Parses the # skopeo inspect ... comments in Dockerfiles and auto-updates digests from the registry (handles --override-os windows automatically)

Related Issue

N/A

Checklist

  • I have read the contributing documentation.
  • I signed and signed-off the commits (git commit -S -s ...).
  • I have correctly attributed the author(s) of the code.
  • I have tested the changes locally.
  • I have followed the project's style guidelines.
  • I have updated the documentation, if necessary.
  • I have added tests, if applicable.

Testing Completed

$ ./scripts/bump-images.sh
Current Go builder version: 1.24.0 (mcr.microsoft.com/oss/go/microsoft/golang)

Newer Go versions available:
  1) 1.24.1 (patch)
  ...
  13) 1.24.13 (patch)
  14) 1.25.0 (minor)
  ...
  22) 1.25.8 (minor)
  23) 1.26.0 (minor)
  24) 1.26.1 (minor)
  0) Keep current (1.24.0)

Select version to bump to [0]: 24
Bumping Go version: 1.24.0 → 1.26.1
  GO    cli/Dockerfile: 1.24.0 → 1.26.1
  ...

Additional Notes

N/A

@nddq
Quang Nguyen (nddq) requested a review from a team as a code owner March 30, 2026 22:48
@nddq Quang Nguyen (nddq) added the dependencies Pull requests that update a dependency file label Mar 30, 2026
@github-actions

github-actions Bot commented Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Retina Code Coverage Report

Total coverage no change

Decreased diff

Impacted Files Coverage
pkg/controllers/operator/retinaendpoint/retinaendpoint_controller.go 83.28% ... 82.25% (-1.03%) ⬇️

@nddq
chore(deps): bump Go builder to 1.26.1 and update base images
90960aa 
Go 1.26.0 → 1.26.1 (fixes CVE-2026-25679, CVE-2026-27137,
CVE-2026-27138, CVE-2026-27142, CVE-2026-27139).

Base images updated to latest digests:
- azurelinux/distroless/minimal:3.0
- windows/nanoserver:ltsc2022
- windows/servercore:ltsc2022

bump-images.sh now detects newer Go minor/patch versions from the
registry and prompts the user to select which version to bump to
before updating digests.

Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
@nddq Quang Nguyen (nddq) mentioned this pull request Apr 3, 2026
Closed
7 tasks
@nddq
Quang Nguyen (nddq) added this pull request to the merge queue Apr 3, 2026
Merged via the queue into main with commit ab10de7 Apr 3, 2026
36 checks passed
@nddq
Quang Nguyen (nddq) deleted the chore/bump-base-images branch April 3, 2026 17:34
Laksh (lakshk98) pushed a commit to lakshk98/retina that referenced this pull request Aug 4, 2026
@nddq @lakshk98
chore(deps): bump Go builder to 1.26.1 and update base images (micros…
eac666c 
…oft#2151)

# Description

Go 1.26.0 has 4 stdlib CVEs with fixes in 1.26.1 (CVE-2026-25679,
CVE-2026-27137, CVE-2026-27138, CVE-2026-27142). This PR bumps the Go
builder images to 1.26.1 and updates all base image digests to latest.

Image digest updates:
- `oss/go/microsoft/golang` 1.26.0 → 1.26.1 (azurelinux3.0, plain,
windowsservercore-ltsc2022)
- `azurelinux/base/core:3.0` → latest digest
- `azurelinux/distroless/minimal:3.0` → latest digest
- `windows/nanoserver:ltsc2022` → latest digest
- `windows/servercore:ltsc2022` → latest digest
- `mirror/docker/library/ubuntu:24.04` → pinned by digest (was tag-only)

Also adds `make bump-images` (`scripts/bump-images.sh`) which:
1. Checks for newer Go minor/patch versions from the registry and
prompts the user to select which version to bump to
2. Parses the `# skopeo inspect ...` comments in Dockerfiles and
auto-updates digests from the registry (handles `--override-os windows`
automatically)

## Related Issue

N/A

## Checklist

- [x] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [x] I signed and signed-off the commits (`git commit -S -s ...`).
- [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [ ] I have updated the documentation, if necessary.
- [ ] I have added tests, if applicable.

## Testing Completed

```
$ ./scripts/bump-images.sh
Current Go builder version: 1.24.0 (mcr.microsoft.com/oss/go/microsoft/golang)

Newer Go versions available:
  1) 1.24.1 (patch)
  ...
  13) 1.24.13 (patch)
  14) 1.25.0 (minor)
  ...
  22) 1.25.8 (minor)
  23) 1.26.0 (minor)
  24) 1.26.1 (minor)
  0) Keep current (1.24.0)

Select version to bump to [0]: 24
Bumping Go version: 1.24.0 → 1.26.1
  GO    cli/Dockerfile: 1.24.0 → 1.26.1
  ...
```

## Additional Notes

N/A

Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Laksh (lakshk98) pushed a commit to lakshk98/retina that referenced this pull request Aug 4, 2026
@nddq @lakshk98
chore(deps): bump Go builder to 1.26.1 and update base images (micros…
3e3b97b 
…oft#2151)

# Description

Go 1.26.0 has 4 stdlib CVEs with fixes in 1.26.1 (CVE-2026-25679,
CVE-2026-27137, CVE-2026-27138, CVE-2026-27142). This PR bumps the Go
builder images to 1.26.1 and updates all base image digests to latest.

Image digest updates:
- `oss/go/microsoft/golang` 1.26.0 → 1.26.1 (azurelinux3.0, plain,
windowsservercore-ltsc2022)
- `azurelinux/base/core:3.0` → latest digest
- `azurelinux/distroless/minimal:3.0` → latest digest
- `windows/nanoserver:ltsc2022` → latest digest
- `windows/servercore:ltsc2022` → latest digest
- `mirror/docker/library/ubuntu:24.04` → pinned by digest (was tag-only)

Also adds `make bump-images` (`scripts/bump-images.sh`) which:
1. Checks for newer Go minor/patch versions from the registry and
prompts the user to select which version to bump to
2. Parses the `# skopeo inspect ...` comments in Dockerfiles and
auto-updates digests from the registry (handles `--override-os windows`
automatically)

## Related Issue

N/A

## Checklist

- [x] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [x] I signed and signed-off the commits (`git commit -S -s ...`).
- [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [ ] I have updated the documentation, if necessary.
- [ ] I have added tests, if applicable.

## Testing Completed

```
$ ./scripts/bump-images.sh
Current Go builder version: 1.24.0 (mcr.microsoft.com/oss/go/microsoft/golang)

Newer Go versions available:
  1) 1.24.1 (patch)
  ...
  13) 1.24.13 (patch)
  14) 1.25.0 (minor)
  ...
  22) 1.25.8 (minor)
  23) 1.26.0 (minor)
  24) 1.26.1 (minor)
  0) Keep current (1.24.0)

Select version to bump to [0]: 24
Bumping Go version: 1.24.0 → 1.26.1
  GO    cli/Dockerfile: 1.24.0 → 1.26.1
  ...
```

## Additional Notes

N/A

Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ibezrukavyi ibezrukavyi ibezrukavyi approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@nddq @ibezrukavyi