Repository navigation
build: bump Go to 1.26.10 for the eMudhra CA distrust (CVE-2026-111943) - #38
Conversation
Go releases before 1.26.10 (and 1.27.3) still trust eight compromised eMudhra intermediate CAs (CVE-2026-111943); 1.26.10 adds them to the crypto/x509 denylist, and older Go lines get no fix. This raises the Go version of the `tests` module to 1.26.10 and pins the `setup-go` steps in CI to match, along with the stated prerequisite in the README.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update Go version references .github/actions/build-flavor/action.yml, .github/workflows/pr_test_latest.yaml, .github/workflows/test_images.yaml, tests/go.mod, README.md, CHANGELOG.md |
CI setup, the tests module, and local testing documentation now specify Go 1.26.10. The Unreleased changelog notes the image-test version update and cites CVE-2026-111943. |
Priority:
Merge Risk: 
51be6
-
No actionable merge-blocking risk was identified in the version update.
Pre-merge checks: 
-
Check name Status Explanation Description check The description clearly explains the Go 1.26.10 upgrade, CI and module changes, README update, security rationale, and verification status. Title check The title clearly and concisely identifies the main change: upgrading Go to 1.26.10 to address the eMudhra CA distrust vulnerability. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (6 skipped: 6 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the Go version bright,
Across the workflows, all aligned.
Test notes follow close behind,
The changelog records the change in kind.
One neat update, from paw to page,
Hop along to the next test stage!
Comment @coderabbitai help to get the list of available commands.
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Go releases before 1.26.10 (and 1.27.3) still trust eight compromised eMudhra intermediate CAs (CVE-2026-111943); 1.26.10 adds them to the crypto/x509 denylist, and older Go lines get no fix. This raises the Go version of the
testsmodule to 1.26.10 and pins thesetup-gosteps in CI to match, along with the stated prerequisite in the README.Verified locally with
go build.go vet(and thereforego test) fails ontests/main.go:524(non-constant format string infmt.Errorf), which is already the case onmainand is left alone here; the image tests themselves need Docker and were not run.