Repository navigation
fix(security): build with Go 1.26.10 for eMudhra intermediate distrust - #258
Merged
Merged
Conversation
Go 1.26.10 makes crypto/x509 reject certificate chains through the compromised eMudhra intermediates (golang/go#82345, INC-289). This action sends LaunchDarkly API tokens over TLS, so the published image needs it. - go.mod: toolchain go1.26.8 -> go1.26.10 (go directive unchanged) - Dockerfile: builder golang:1.26.8-alpine -> golang:1.26.10-alpine - AGENTS.md: correct the stale Go version note Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-by: termag
cchu-ld
approved these changes
Oct 21, 2026
Merged
cchu-ld
added a commit
that referenced
this pull request
Oct 21, 2026
Prepares the 2.3.4 release, same approach as 2.3.3 in #256. Ships the Go 1.26.10 toolchain and `golang:1.26.10-alpine` builder pin from #258, so `crypto/x509` rejects chains through the distrusted eMudhra intermediates (INC-289, golang/go#82345). No code changes: only the version constant, the changelog and the `dockerImage` pins. Users on `@v2` get this once `v2` moves to `v2.3.4`; GitHub builds the root Action from the Dockerfile on each run. The `docker/` entry point is still unaffected by this release: Publish Docker image has failed on every run, and `launchdarkly/find-code-references-in-pull-request` does not exist on Docker Hub. The release notes should keep the 2.3.3 caveat. Release steps after merge: [Releasing the Code References tools](https://launchdarkly.atlassian.net/wiki/spaces/PD/pages/5437260080/Releasing+the+Code+References+tools). via LD Research 🤖 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > **Prepares release 2.3.4** by bumping `internal/version.Version` and aligning user-facing image pins from `2.3.3` to `2.3.4` in `README.md` and the `docker/` Action’s default `dockerImage`. > > The new **2.3.4** changelog entry documents that the release builds on **Go 1.26.10** (toolchain and `golang:` builder) so `crypto/x509` rejects chains through distrusted eMudhra intermediates (INC-289); **this PR’s diff has no application or `go.mod`/`Dockerfile` edits**—only version, changelog, and documentation pins. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 3b64368. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins the toolchain and Docker builder image to Go 1.26.10 so crypto/x509 rejects chains through the compromised eMudhra intermediates (INC-289, golang/go#82345). A new release and image publish are needed to ship this to customers.
🤖 Generated with Claude Code
Opened from termag
Note
Overview
Bumps the Go build toolchain and Docker builder image from 1.26.8 to 1.26.10 so compiled binaries pick up updated
crypto/x509behavior that rejects TLS chains through compromised eMudhra intermediates (INC-289 / golang/go#82345).go.modupdates thetoolchaindirective; the multi-stageDockerfilebuilder stage usesgolang:1.26.10-alpine. AGENTS.md now documentsgo 1.26.0withtoolchain go1.26.10and reminds contributors to keep the Dockerfilegolang:tag aligned. No application logic changes—customers need a new release/image publish to receive the fix.Reviewed by Cursor Bugbot for commit 8cc0bd1. Bugbot is set up for automated code reviews on this repo. Configure here.