deps: bump the golang-base group across 6 directories with 1 update - #2668
Merged
Quang Nguyen (nddq) merged 1 commit intoAug 19, 2026
Merged
Conversation
dependabot
Bot
added
area/dependencies
dependabot
Bot
added
the
area/dependencies
Bumps the golang-base group with 1 update in the /cli directory: oss/go/microsoft/golang. Bumps the golang-base group with 1 update in the /controller directory: oss/go/microsoft/golang. Bumps the golang-base group with 1 update in the /hack/tools/kapinger directory: oss/go/microsoft/golang. Bumps the golang-base group with 1 update in the /hack/tools/toolbox directory: oss/go/microsoft/golang. Bumps the golang-base group with 1 update in the /operator directory: oss/go/microsoft/golang. Bumps the golang-base group with 1 update in the /test/image directory: oss/go/microsoft/golang. Updates `oss/go/microsoft/golang` from `1c77c1c` to `aa11e32` Updates `oss/go/microsoft/golang` from `1c77c1c` to `aa11e32` Updates `oss/go/microsoft/golang` from `be89027` to `ea712a1` Updates `oss/go/microsoft/golang` from `be89027` to `ea712a1` Updates `oss/go/microsoft/golang` from `1c77c1c` to `aa11e32` Updates `oss/go/microsoft/golang` from `1c77c1c` to `aa11e32` --- updated-dependencies: - dependency-name: oss/go/microsoft/golang dependency-version: 1.26.5-2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang-base - dependency-name: oss/go/microsoft/golang dependency-version: 1.26.5-2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang-base - dependency-name: oss/go/microsoft/golang dependency-version: 1.26.5-2-azurelinux3.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang-base - dependency-name: oss/go/microsoft/golang dependency-version: 1.26.5-2-azurelinux3.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang-base - dependency-name: oss/go/microsoft/golang dependency-version: 1.26.5-2-azurelinux3.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang-base - dependency-name: oss/go/microsoft/golang dependency-version: 1.26.5-2-windowsservercore-ltsc2022 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: golang-base ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/docker/cli/golang-base-2dff33e175
branch
from
August 18, 2026 19:44
6e4d3dc to
6c31ba4
Compare
Quang Nguyen (nddq)
approved these changes
Aug 19, 2026
Quang Nguyen (nddq)
added a commit
that referenced
this pull request
Aug 19, 2026
Go 1.26.6 fixes 8 stdlib advisories that govulncheck reports against this repo: GO-2026-5026, GO-2026-5942, GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, and GO-2026-6218. Seven are reachable calls, and one is an import. Trivy reports the same stdlib version in the shipped binaries, so the bump also clears those findings for retina-agent, retina-operator, retina-init, and kubectl-retina. The skopeo comment above each FROM line still named 1.26.3, and the comment on the agent stage still named a distroless digest that an earlier base image bump replaced. Both now match the pins they document. Dependabot proposed a digest refresh of 1.26.5-2 instead (#2668). MCR re-pushes the 1.26.6 tag every 2 to 3 days, so the tag rarely sits outside the cooldown window when dependabot runs. Signed-off-by: Quang Nguyen <28567936+nddq@users.noreply.github.com>
Quang Nguyen (nddq)
deleted the
dependabot/docker/cli/golang-base-2dff33e175
branch
August 19, 2026 17:20
Quang Nguyen (nddq)
added a commit
that referenced
this pull request
Aug 19, 2026
Go 1.26.6 fixes 8 stdlib advisories that govulncheck reports against this repo: GO-2026-5026, GO-2026-5942, GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, and GO-2026-6218. Seven are reachable calls, and one is an import. Trivy reports the same stdlib version in the shipped binaries, so the bump also clears those findings for retina-agent, retina-operator, retina-init, and kubectl-retina. The skopeo comment above each FROM line still named 1.26.3, and the comment on the agent stage still named a distroless digest that an earlier base image bump replaced. Both now match the pins they document. Dependabot could not offer this bump. It refreshed the 1.26.5-2 digest instead (#2668). MCR re-pushes the 1.26.6 tag every 2 to 3 days, so the tag rarely sits outside the cooldown window when dependabot runs. Signed-off-by: Quang Nguyen <28567936+nddq@users.noreply.github.com>
7 tasks
Quang Nguyen (nddq)
added a commit
that referenced
this pull request
Aug 20, 2026
A patch tag gives dependabot two ways to update the image: move the tag to a newer patch, or refresh the digest of the current tag. When the newer patch sits inside the cooldown window, dependabot takes the second path. #2668 did that, and left the build on Go 1.26.5, which 8 stdlib advisories affect. The 1.26 tag removes the second path. The tag never changes, so a digest refresh is the patch upgrade. The digest still pins the exact image. The pinned digest provides Go 1.26.7. govulncheck inside that image reports no standard library findings, against 8 on Go 1.26.5. The workflow read the patch version out of the tag, which a minor tag does not carry. It now reads GOLANG_VERSION from the image config, and fails when that value is empty instead of letting setup-go pick a default. The skopeo comments named 1.26.3, and the agent stage comment named a distroless digest that an earlier bump replaced. Both now match the pins they document. Signed-off-by: Quang Nguyen <28567936+nddq@users.noreply.github.com>
pull Bot
pushed a commit
to TheTechOddBug/retina
that referenced
this pull request
Aug 21, 2026
# Description A patch tag gives dependabot two ways to update the golang image: move the tag to a newer patch, or refresh the digest of the current tag. When the newer patch sits inside the cooldown window, dependabot takes the second path. microsoft#2668 did that. It refreshed the `1.26.5-2` digest and left the build on Go 1.26.5, which 8 stdlib advisories affect. The `1.26` tag removes the second path. The tag never changes, so a digest refresh is the patch upgrade, and dependabot cannot report progress without delivering the fix. The digest still pins the exact image, so builds stay reproducible. This covers 13 `FROM` lines in 11 Dockerfiles, across all three tag variants: `-azurelinux3.0`, bare, and `-windowsservercore-ltsc2022`. `Azure/azure-container-networking` pins the same way. **Workflow.** The govulncheck job read the patch version out of the tag, which a minor tag does not carry. It now reads `GOLANG_VERSION` from the image config, so the scan still matches the toolchain the images build with. It also fails when that value is empty, rather than letting `setup-go` install a default. **Comments.** The `skopeo inspect` line above each `FROM` named `1.26.3`, and the comment on the agent stage named a distroless digest that an earlier bump replaced. Both now match the pins they document. The golang comments name the floating tag, so they cannot drift again. ## Related Issue N/A. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). See [this documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification) on signing commits. - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. ## Screenshots (if applicable) or Testing Completed The pinned digest provides Go 1.26.7. govulncheck run inside that image reports no standard library findings, against 8 on Go 1.26.5: ``` $ go version go version go1.26.7 linux/amd64 $ govulncheck ./... Vulnerability #1: GO-2026-6238 Integer overflow in BTF parsing in github.com/cilium/ebpf Found in: github.com/cilium/ebpf@v0.21.0 Fixed in: github.com/cilium/ebpf@v0.22.0 Your code is affected by 1 vulnerability from 1 module. ``` The reworked workflow step, run against `controller/Dockerfile`, reports: ``` builder image mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:3960d75b... provides Go 1.26.7 version=1.26.7 ``` The remaining reachable finding is `github.com/cilium/ebpf`, which microsoft#2493 fixes. The govulncheck job stays red until that lands. ## Additional Notes N/A. Signed-off-by: Quang Nguyen <28567936+nddq@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the golang-base group with 1 update in the /cli directory: oss/go/microsoft/golang.
Bumps the golang-base group with 1 update in the /controller directory: oss/go/microsoft/golang.
Bumps the golang-base group with 1 update in the /hack/tools/kapinger directory: oss/go/microsoft/golang.
Bumps the golang-base group with 1 update in the /hack/tools/toolbox directory: oss/go/microsoft/golang.
Bumps the golang-base group with 1 update in the /operator directory: oss/go/microsoft/golang.
Bumps the golang-base group with 1 update in the /test/image directory: oss/go/microsoft/golang.
Updates
oss/go/microsoft/golangfrom1c77c1ctoaa11e32Updates
oss/go/microsoft/golangfrom1c77c1ctoaa11e32Updates
oss/go/microsoft/golangfrombe89027toea712a1Updates
oss/go/microsoft/golangfrombe89027toea712a1Updates
oss/go/microsoft/golangfrom1c77c1ctoaa11e32Updates
oss/go/microsoft/golangfrom1c77c1ctoaa11e32