From 5a69c63be0c601093ffe3c26c997a8a3fb3ae30a Mon Sep 17 00:00:00 2001 From: DoDiODev Date: Tue, 27 Oct 2026 10:53:01 +0100 Subject: [PATCH] build: bump Go to 1.27.3, align Node and MySQL pins Follow-up to #9217 and #9251/#9254 for pins that Dependabot does not track. - Go 1.27.2 -> 1.27.3 (security fixes in crypto/x509, released 2026-10-19): backend/scripts/install-go.sh and the lake-builder Dockerfile, including the official SHA256 checksums from go.dev, plus the "Install Go" step names. go.mod keeps "go 1.27.0"; golang:1.27-bookworm already floats to the latest patch. - config-ui/.tool-versions: nodejs 24.19.0 -> 24.22.1, matching the Volta pin from #9251 (Node.js security release of 2026-10-21). - mysql 8.4.11 -> 8.4.13 in docker-compose-dev-mysql.yml and the e2e workflow service, matching the compose files bumped in #9254 (Dependabot's compose fetcher does not match docker-compose-dev-*.yml, and github-actions updates do not cover services:). --- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/migration-script-lint.yml | 2 +- .github/workflows/test-e2e.yml | 6 +++--- .github/workflows/test.yml | 2 +- backend/scripts/install-go.sh | 6 +++--- config-ui/.tool-versions | 2 +- devops/docker/lake-builder/Dockerfile | 4 ++-- docker-compose-dev-mysql.yml | 2 +- 8 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index cfb40ff69e1..3027cc3e519 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -34,7 +34,7 @@ jobs: run: git config --global --add safe.directory $(pwd) - name: Install libgit2 1.5 for git2go v34 run: backend/scripts/install-libgit2.sh - - name: Install Go 1.27.2 + - name: Install Go 1.27.3 run: backend/scripts/install-go.sh - name: Install mockery 3.8.1 run: backend/scripts/install-mockery.sh diff --git a/.github/workflows/migration-script-lint.yml b/.github/workflows/migration-script-lint.yml index 7079d7d6836..ac1d24ef2ac 100644 --- a/.github/workflows/migration-script-lint.yml +++ b/.github/workflows/migration-script-lint.yml @@ -30,7 +30,7 @@ jobs: container: mericodev/lake-builder:latest steps: - uses: actions/checkout@v7 - - name: Install Go 1.27.2 + - name: Install Go 1.27.3 run: backend/scripts/install-go.sh - name: migration script linting run: | diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml index 349f57fcf5e..caaad209bcf 100644 --- a/.github/workflows/test-e2e.yml +++ b/.github/workflows/test-e2e.yml @@ -39,7 +39,7 @@ jobs: runs-on: ubuntu-latest services: db: - image: mysql:8.4.11 + image: mysql:8.4.13 env: MYSQL_DATABASE: lake MYSQL_USER: merico @@ -52,7 +52,7 @@ jobs: - run: git config --global --add safe.directory $(pwd) - name: Install libgit2 1.5 for git2go v34 run: backend/scripts/install-libgit2.sh - - name: Install Go 1.27.2 + - name: Install Go 1.27.3 run: backend/scripts/install-go.sh - name: Build Python run: | @@ -96,7 +96,7 @@ jobs: - run: git config --global --add safe.directory $(pwd) - name: Install libgit2 1.5 for git2go v34 run: backend/scripts/install-libgit2.sh - - name: Install Go 1.27.2 + - name: Install Go 1.27.3 run: backend/scripts/install-go.sh - name: Build Python run: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 47c03658d6d..80509042e6c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -49,7 +49,7 @@ jobs: run: git config --global --add safe.directory $(pwd) - name: Install libgit2 1.5 for git2go v34 run: backend/scripts/install-libgit2.sh - - name: Install Go 1.27.2 + - name: Install Go 1.27.3 run: backend/scripts/install-go.sh - name: Check go.mod is tidy without generated mocks run: | diff --git a/backend/scripts/install-go.sh b/backend/scripts/install-go.sh index 02510cf3364..232e709eb5e 100755 --- a/backend/scripts/install-go.sh +++ b/backend/scripts/install-go.sh @@ -17,7 +17,7 @@ set -eu -GO_VERSION=1.27.2 +GO_VERSION=1.27.3 INSTALL_DIR=/opt/go/$GO_VERSION GO_BIN=$INSTALL_DIR/bin/go @@ -54,11 +54,11 @@ fi case "$(uname -m)" in x86_64|amd64) archive_name=go${GO_VERSION}.linux-amd64.tar.gz - archive_sha256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 + archive_sha256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 ;; aarch64|arm64) archive_name=go${GO_VERSION}.linux-arm64.tar.gz - archive_sha256=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8 + archive_sha256=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 ;; *) echo "unsupported architecture: $(uname -m)" >&2 diff --git a/config-ui/.tool-versions b/config-ui/.tool-versions index 12376e4f09b..af0f6c611bf 100644 --- a/config-ui/.tool-versions +++ b/config-ui/.tool-versions @@ -1 +1 @@ -nodejs 24.19.0 +nodejs 24.22.1 diff --git a/devops/docker/lake-builder/Dockerfile b/devops/docker/lake-builder/Dockerfile index 520eeae820c..95cd0544eef 100644 --- a/devops/docker/lake-builder/Dockerfile +++ b/devops/docker/lake-builder/Dockerfile @@ -64,8 +64,8 @@ ENV PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig # 2022, so the image could no longer be rebuilt. Fetch the official archive # from go.dev and verify it. Version and checksum match # backend/scripts/install-go.sh. -ARG GO_VERSION=1.27.2 -ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 +ARG GO_VERSION=1.27.3 +ARG GO_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 RUN curl --fail --location --retry 3 "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" --output /tmp/go.tar.gz &&\ echo "${GO_SHA256} /tmp/go.tar.gz" | sha256sum --check --strict &&\ tar -C /usr/local -xzf /tmp/go.tar.gz && rm /tmp/go.tar.gz &&\ diff --git a/docker-compose-dev-mysql.yml b/docker-compose-dev-mysql.yml index 8f654b533b0..716252295a7 100644 --- a/docker-compose-dev-mysql.yml +++ b/docker-compose-dev-mysql.yml @@ -18,7 +18,7 @@ name: devlake-mysql services: mysql: - image: mysql:8.4.11 + image: mysql:8.4.13 volumes: - mysql-storage:/var/lib/mysql restart: always