From 508745046a4aab63dc7a10ddcf239cd570c342c4 Mon Sep 17 00:00:00 2001 From: Jordan Evans Date: Wed, 14 Oct 2026 13:49:59 -0700 Subject: [PATCH] fix: upgrade Go toolchain to remediate OSV findings Upgrade to Go 1.26.9 and refresh module dependencies to address the stdlib advisories failing MegaLinter. Select and verify the go.mod toolchain in a fail-closed MegaLinter pre-command, propagating GOTOOLCHAIN to linters without disabling vulnerability scanning. Document the effective CI toolchain and compatibility policy. Issue: linuxfoundation/lfx-self-serve-ops#509 Co-authored-by: Copilot Signed-off-by: Jordan Evans --- .mega-linter.yml | 12 ++++++++++++ AGENTS.md | 22 +++++++++++++--------- README.md | 4 ++++ go.mod | 14 +++++++------- go.sum | 24 ++++++++++++------------ 5 files changed, 48 insertions(+), 28 deletions(-) diff --git a/.mega-linter.yml b/.mega-linter.yml index b93d824..fd80ee1 100644 --- a/.mega-linter.yml +++ b/.mega-linter.yml @@ -2,6 +2,18 @@ # SPDX-License-Identifier: MIT --- GITHUB_COMMENT_REPORTER: false +# The image's bundled Go can lag security patches. Select and download the +# checksum-verified toolchain from go.mod before any linters run, for both +# GitHub Actions and local MegaLinter runs. Propagate it to linter subprocesses. +PRE_COMMANDS: + - command: |- + set -eu + export GOTOOLCHAIN="go$(awk '$1 == "go" { print $2; exit }' go.mod)" + go version + cwd: workspace + continue_if_failed: false + output_variables: + - GOTOOLCHAIN DISABLE_LINTERS: # Prefer Revive. - GO_GOLANGCI_LINT diff --git a/AGENTS.md b/AGENTS.md index 1d20caf..91d047f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -240,10 +240,11 @@ release binaries may be missing even though the GitHub Release exists. latest available *patch* release (e.g. `1.X.Y` → `1.X.{Y+1}`) to pick up security fixes. Do **not** bump the *minor* version (e.g. `1.X.x` → `1.{X+1}.x`) unless the user explicitly asks for it, **and** you've - validated it against the Go version MegaLinter itself bundles -- - MegaLinter runs several linters (e.g. `golangci-lint`) against its own - bundled Go version, and a `go.mod` directive newer than that bundled - version breaks those checks. + validated it against the effective Go runtime and Go-based linters used + by MegaLinter. `.mega-linter.yml` selects `GOTOOLCHAIN` from `go.mod` in a + fail-closed pre-command, downloads it with Go's checksum verification, + and propagates it to linter subprocesses. This keeps CI and local + MegaLinter runs on the patched runtime even when the image lags behind. To find MegaLinter's bundled Go version: @@ -258,11 +259,14 @@ release binaries may be missing even though the GitHub Release exists. | grep -i 'GO_ALPINE_VERSION\|GO_IMAGE_VERSION' ``` - `go.mod`'s `go` directive must never exceed that bundled version. Staying - one minor version behind it (rather than matching its minor *and* patch - exactly) leaves room to always take the latest patch release for security - fixes without ever being blocked by MegaLinter's own bundled patch version - lagging behind a newly disclosed vulnerability. + The bundled version is only the bootstrap runtime; the effective runtime + must meet `go.mod`'s requirement. Go-based linters also have their own + build-toolchain constraints, so upgrading the runtime alone does not + guarantee linter compatibility. `GO_GOLANGCI_LINT` is currently disabled + in MegaLinter; validate its build-toolchain compatibility before enabling + it. Keep the pinned Revive compatible and verify the full MegaLinter run + when upgrading Go. Do not keep an unsupported Go minor version solely + to stay behind the image's bundled runtime. There's no built-in `go` subcommand to look up the latest patch release for a given minor version -- query the official `go.dev/dl` JSON feed diff --git a/README.md b/README.md index 108abe5..cae5acd 100644 --- a/README.md +++ b/README.md @@ -83,6 +83,10 @@ Run `lfx --help` or `lfx --help` for full details on any command. ## Development +Use Go 1.26.9 or newer (see `go.mod`). Build and release workflows read this +version from `go.mod`; MegaLinter also selects and downloads that toolchain +before linting, so local MegaLinter runs require network access on first use. + ```bash make build # Build ./bin/lfx make check # Format, vet, and lint diff --git a/go.mod b/go.mod index b62eed4..73fad2b 100644 --- a/go.mod +++ b/go.mod @@ -2,14 +2,14 @@ // SPDX-License-Identifier: MIT module github.com/linuxfoundation/lfx-cli -go 1.25.14 +go 1.26.9 require ( github.com/99designs/keyring v1.2.2 - github.com/tidwall/gjson v1.19.0 + github.com/tidwall/gjson v1.20.0 github.com/urfave/cli-docs/v3 v3.1.0 - github.com/urfave/cli/v3 v3.13.0 - golang.org/x/oauth2 v0.36.0 + github.com/urfave/cli/v3 v3.14.0 + golang.org/x/oauth2 v0.37.0 ) require ( @@ -22,7 +22,7 @@ require ( github.com/mtibben/percent v0.2.1 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/tidwall/match v1.2.0 // indirect - github.com/tidwall/pretty v1.2.1 // indirect - golang.org/x/sys v0.47.0 // indirect - golang.org/x/term v0.45.0 // indirect + github.com/tidwall/pretty v1.2.2 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/term v0.47.0 // indirect ) diff --git a/go.sum b/go.sum index 9cc8e0b..f04fee6 100644 --- a/go.sum +++ b/go.sum @@ -25,23 +25,23 @@ github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= -github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU= -github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc= +github.com/tidwall/gjson v1.20.0 h1:+agJ3rEzKcCXKDKo0ml26UROcpcAlnZyjq+TjbY5Fto= +github.com/tidwall/gjson v1.20.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc= github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM= github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM= -github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4= -github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU= +github.com/tidwall/pretty v1.2.2 h1:dz1jrRuE7or/74V490B4/GP1pZm5WKlt2bgCP5A83w8= +github.com/tidwall/pretty v1.2.2/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU= github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw= github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to= -github.com/urfave/cli/v3 v3.13.0 h1:Dr6jqMfIyyFsRVn7Nz5mqLsMY+ZMpfh3a0aMs+umPVY= -github.com/urfave/cli/v3 v3.13.0/go.mod h1:vXn6HxPNccJSzQr2QvwVncOKrgYGIHU0HY5h8B2nQj4= +github.com/urfave/cli/v3 v3.14.0 h1:a8414NQlHJs0c/iBsulKLzlES0n/lEAskbL2LKpU4/s= +github.com/urfave/cli/v3 v3.14.0/go.mod h1:vXn6HxPNccJSzQr2QvwVncOKrgYGIHU0HY5h8B2nQj4= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b h1:QRR6H1YWRnHb4Y/HeNFCTJLFVxaq6wH4YuVdsUOr75U= gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=