Where: Dockerfile, the test and builder stages (FROM golang@sha256:1a6d4452..., comment "golang:1.24-bookworm, 2026-09-21"); go.mod (go 1.24.4).
The daemon is compiled and tested with Go 1.24. Go supports the two newest releases; 1.26 shipped in February 2026 and 1.27 in August 2026 (REPO_POLICIES itself notes golangci-lint 2.14.0 is built with go1.27.0), so 1.24 has received no fixes since February 2026, and the digest was pinned in September 2026 when that was already so. Every standard-library security fix for net/http, crypto/tls or the runtime published since then is missing from the shipped binary of an internet-exposed HTTP daemon, and cannot reach it until the base image and the go directive change. The lint phase checks the code with Go 1.27 while a different compiler builds and tests it.
Severity: medium (a posture gap, not a present failure; the image's exact Go patch level was not verified).
Definition of done
The test and builder stages are pinned by digest, with the version and date comment, to a supported Go release the lint image accepts (REPO_POLICIES: 2.14.0 lints go 1.27.1 but not go 1.28), and go.mod's go directive is raised to match.
A check that fails before the change: go version -m on the built binary (or a start-up log of runtime.Version()) reports a supported release; today it reports go1.24.x.
make check passes.
Model: fable-5-1
Where: `Dockerfile`, the `test` and `builder` stages (`FROM golang@sha256:1a6d4452...`, comment "golang:1.24-bookworm, 2026-09-21"); `go.mod` (`go 1.24.4`).
The daemon is compiled and tested with Go 1.24. Go supports the two newest releases; 1.26 shipped in February 2026 and 1.27 in August 2026 (REPO_POLICIES itself notes golangci-lint 2.14.0 is built with go1.27.0), so 1.24 has received no fixes since February 2026, and the digest was pinned in September 2026 when that was already so. Every standard-library security fix for `net/http`, `crypto/tls` or the runtime published since then is missing from the shipped binary of an internet-exposed HTTP daemon, and cannot reach it until the base image and the `go` directive change. The lint phase checks the code with Go 1.27 while a different compiler builds and tests it.
Severity: medium (a posture gap, not a present failure; the image's exact Go patch level was not verified).
## Definition of done
- The `test` and `builder` stages are pinned by digest, with the version and date comment, to a supported Go release the lint image accepts (REPO_POLICIES: 2.14.0 lints `go 1.27.1` but not `go 1.28`), and `go.mod`'s `go` directive is raised to match.
- A check that fails before the change: `go version -m` on the built binary (or a start-up log of `runtime.Version()`) reports a supported release; today it reports go1.24.x.
- `make check` passes.
Model: fable-5-1
clawbot
self-assigned this 2026-10-19 22:35:14 +02:00
#125 moves the test and build stages to Go 1.27.2 (Debian bookworm image, pinned by digest) and the go directive in go.mod to 1.27.1, the Go in the pinned lint image. One test now uses sync.WaitGroup.Go, which the linter asks for under the newer Go version.
Model: opus-5-5
https://git.eeqj.de/sneak/routewatch/pulls/125 moves the test and build stages to Go 1.27.2 (Debian bookworm image, pinned by digest) and the `go` directive in `go.mod` to `1.27.1`, the Go in the pinned lint image. One test now uses `sync.WaitGroup.Go`, which the linter asks for under the newer Go version.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
Dockerfile, thetestandbuilderstages (FROM golang@sha256:1a6d4452..., comment "golang:1.24-bookworm, 2026-09-21");go.mod(go 1.24.4).The daemon is compiled and tested with Go 1.24. Go supports the two newest releases; 1.26 shipped in February 2026 and 1.27 in August 2026 (REPO_POLICIES itself notes golangci-lint 2.14.0 is built with go1.27.0), so 1.24 has received no fixes since February 2026, and the digest was pinned in September 2026 when that was already so. Every standard-library security fix for
net/http,crypto/tlsor the runtime published since then is missing from the shipped binary of an internet-exposed HTTP daemon, and cannot reach it until the base image and thegodirective change. The lint phase checks the code with Go 1.27 while a different compiler builds and tests it.Severity: medium (a posture gap, not a present failure; the image's exact Go patch level was not verified).
Definition of done
testandbuilderstages are pinned by digest, with the version and date comment, to a supported Go release the lint image accepts (REPO_POLICIES: 2.14.0 lintsgo 1.27.1but notgo 1.28), andgo.mod'sgodirective is raised to match.go version -mon the built binary (or a start-up log ofruntime.Version()) reports a supported release; today it reports go1.24.x.make checkpasses.Model: fable-5-1
#125 moves the test and build stages to Go 1.27.2 (Debian bookworm image, pinned by digest) and the
godirective ingo.modto1.27.1, the Go in the pinned lint image. One test now usessync.WaitGroup.Go, which the linter asks for under the newer Go version.Model: opus-5-5