security: bump Go toolchain to 1.26.11 for GO-2026-6859 (govulncheck fails)

Open Beginner friendly
  • Is something wrong?
#3,624 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
build-system, security

Research direction

Start by running git grep -n '1\.26\.10' to locate the Go toolchain pins in go.mod, workflow files, and Dockerfiles; use commit 1c7ada0e as prior art. Update the pins to Go 1.26.11 or a newer 1.26 patch, add a security changelog fragment under changelog.d/, and confirm the grep only finds the historical changelog entry. The issue also calls for a passing govulncheck run and verifying built binaries or images report the updated Go version.

Written by the indexing model from the issue text.

Description

model:sonnet runtime:claude security size:S

Problem

The Vulnerability Check (govulncheck) job fails on PRs because the Go toolchain is pinned at 1.26.10, which carries GO-2026-6859 (standard library, net/http). It is fixed in go1.26.11. The job fails when a finding has a fix available.

Seen on PR #3615 (head 71e0ce1f), a docs and CLI change that touches none of the reported code. The reported call paths run through existing code in internal/gateway, internal/modelgateway and internal/codeegress. The run is https://github.com/FootprintAI/Containarium/actions/runs/42954570595

The same scan also lists GO-2026-6911 in github.com/mark3labs/mcp-go v1.4.0. It has no fix (Fixed in: N/A) and the scan says the code does not call it, so it does not fail the job. Not part of this issue.

Not yet confirmed

main's newest Security Scanning run (2026-11-11 02:58Z) was green. It ran before this advisory was in the vulnerability database, or it uses a different trigger. Whether main is red now is unknown: re-run it first. Other open PRs that passed earlier (for example #3612) will probably fail when they re-run.

Scope

1.26.10 appears 35 times in 25 files on main:

  • go.mod
  • the go-version: pins across .github/workflows/*.yml
  • the base images in images/*/Dockerfile and sidecars/otel-sidecar/Dockerfile
  • the CHANGELOG.md entry from the previous bump (history, leave as is)

Release v0.133.1 and any image built from these Dockerfiles ship the vulnerable stdlib until the bump lands.

Acceptance criteria

  1. Every toolchain pin that said 1.26.10 says 1.26.11, or a newer 1.26 patch if one exists when this is picked up. Find them with git grep -n '1\.26\.10': it must return only the CHANGELOG history.
  2. Vulnerability Check (govulncheck) passes on the PR and on main.
  3. A changelog fragment under changelog.d/ records the bump (security fix).
  4. Binaries and images built after the merge report go1.26.11 (go version -m on the binary, or the Dockerfile FROM tag).

Notes

  • Prior art: commit 1c7ada0e (bump to 1.26.10 for the October advisories) changed the same set of files.
  • Keep the PR to the bump. Do not include the mcp-go finding.

Blocked by: none
Sprint: none (found during W51, #3603; it blocks the green CI of every open PR, including the sprint's)

Related: #3603

Dominant language
Go
Stars
296
Forks
38
Avg merge
7h 34m
Merged PRs (30d)
648

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from FootprintAI/Containarium

All issues in FootprintAI/Containarium

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.