Skip to content

Commit 655f806

Browse files
4RH1T3CT0R74RH1T3CT0R7
authored
chore: bump Go to 1.26.3, fix new CVEs, run go fix modernizers (#5)
Why: - CI security scan was failing on 4 new govulncheck advisories: GO-2026-4982, GO-2026-4980 (html/template), GO-2026-4971 (net), GO-2026-4918 (net/http + golang.org/x/net). All fixed by Go 1.25.10+ and x/net v0.50+. - Stayed on the major track (1.26) instead of just patching, to pick up Green Tea GC (-10..40% GC overhead), cgo +30%, io.ReadAll 2x, and stack-allocated slice backing — all free wins for the API/worker. Changes: - go.mod: go 1.26.3. - Dockerfiles (api, worker, migrate): golang:1.25-alpine -> 1.26-alpine. - golang.org/x/net: v0.49.0 -> v0.53.0 (closes GO-2026-4918). - GitHub Actions: checkout v4->v5, setup-go v5->v6, setup-node v4->v5 (resolves Node20 deprecation warnings). - go fix ./... modernizers: - interface{} -> any (~60 files). - for i := 0; i < N; i++ -> for range N where applicable. - sync.WaitGroup.Add+go+Done pattern -> wg.Go(...) (worker pool). - if x < y { x = y } -> max(x, y) / min(x, y). - intPtr/boolPtr helpers inlined to new(expr) (Go 1.26 syntax); obsolete helpers removed. - Lint cleanup: WriteString(fmt.Sprintf(...)) -> fmt.Fprintf(&buf, ...). - npm audit fix in web/: closes axios (high), brace-expansion, postcss advisories that surfaced between previous green CI and now. Required a tiny TS fix in web/src/api/client.ts where the new axios types make headers['content-type'] non-string (coerced via String(...)). - Docs: CLAUDE.md, docs/README.md mention Go 1.26. Verification (local): - go build ./..., make test, test-race, test-contract: PASS. - make lint (golangci-lint v2.11.4 rebuilt under go1.26.3): 0 issues. - govulncheck ./...: only GO-2026-4887, GO-2026-4883 remain — both in the accepted-list in ci.yml (Moby daemon-side, fix N/A upstream). - npm audit --audit-level=high in web/: 0 vulnerabilities. - npm run build: PASS. - tests/integration: PASS (Postgres on host port 5433). - internal/infrastructure/db integration: 2 pre-existing failures (TestMatchRepositorySuite/{TestGetStuckRunning,TestUpdateStatus_NotFound}, TestTournamentRepositorySuite/TestGetLeaderboard_*) reproduce on main with the same DB state — unrelated to this change.
1 parent 4fd3d33 commit 655f806

73 files changed

Lines changed: 344 additions & 369 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/cd.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
executor_image: ${{ steps.meta-executor.outputs.tags }}
2525

2626
steps:
27-
- uses: actions/checkout@v4
27+
- uses: actions/checkout@v5
2828

2929
- name: Set up Docker Buildx
3030
uses: docker/setup-buildx-action@v3

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,16 @@ jobs:
1111
name: Lint
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/checkout@v4
14+
- uses: actions/checkout@v5
1515

1616
- name: Set up Go
17-
uses: actions/setup-go@v5
17+
uses: actions/setup-go@v6
1818
with:
1919
go-version-file: 'go.mod'
2020
cache: true
2121

2222
- name: Set up Node.js
23-
uses: actions/setup-node@v4
23+
uses: actions/setup-node@v5
2424
with:
2525
node-version: '20'
2626

@@ -114,16 +114,16 @@ jobs:
114114
- 6379:6379
115115

116116
steps:
117-
- uses: actions/checkout@v4
117+
- uses: actions/checkout@v5
118118

119119
- name: Set up Go
120-
uses: actions/setup-go@v5
120+
uses: actions/setup-go@v6
121121
with:
122122
go-version-file: 'go.mod'
123123
cache: true
124124

125125
- name: Set up Node.js
126-
uses: actions/setup-node@v4
126+
uses: actions/setup-node@v5
127127
with:
128128
node-version: '20'
129129

@@ -212,16 +212,16 @@ jobs:
212212
- 6379:6379
213213

214214
steps:
215-
- uses: actions/checkout@v4
215+
- uses: actions/checkout@v5
216216

217217
- name: Set up Go
218-
uses: actions/setup-go@v5
218+
uses: actions/setup-go@v6
219219
with:
220220
go-version-file: 'go.mod'
221221
cache: true
222222

223223
- name: Set up Node.js
224-
uses: actions/setup-node@v4
224+
uses: actions/setup-node@v5
225225
with:
226226
node-version: '20'
227227

@@ -265,16 +265,16 @@ jobs:
265265
runs-on: ubuntu-latest
266266

267267
steps:
268-
- uses: actions/checkout@v4
268+
- uses: actions/checkout@v5
269269

270270
- name: Set up Go
271-
uses: actions/setup-go@v5
271+
uses: actions/setup-go@v6
272272
with:
273273
go-version-file: 'go.mod'
274274
cache: true
275275

276276
- name: Set up Node.js
277-
uses: actions/setup-node@v4
277+
uses: actions/setup-node@v5
278278
with:
279279
node-version: '20'
280280

@@ -313,16 +313,16 @@ jobs:
313313
security-events: write
314314

315315
steps:
316-
- uses: actions/checkout@v4
316+
- uses: actions/checkout@v5
317317

318318
- name: Set up Go
319-
uses: actions/setup-go@v5
319+
uses: actions/setup-go@v6
320320
with:
321321
go-version-file: 'go.mod'
322322
cache: true
323323

324324
- name: Set up Node.js
325-
uses: actions/setup-node@v4
325+
uses: actions/setup-node@v5
326326
with:
327327
node-version: '20'
328328

@@ -432,16 +432,16 @@ jobs:
432432
runs-on: ubuntu-latest
433433

434434
steps:
435-
- uses: actions/checkout@v4
435+
- uses: actions/checkout@v5
436436

437437
- name: Set up Go
438-
uses: actions/setup-go@v5
438+
uses: actions/setup-go@v6
439439
with:
440440
go-version-file: 'go.mod'
441441
cache: true
442442

443443
- name: Set up Node.js
444-
uses: actions/setup-node@v4
444+
uses: actions/setup-node@v5
445445
with:
446446
node-version: '20'
447447

@@ -490,10 +490,10 @@ jobs:
490490
- 6379:6379
491491

492492
steps:
493-
- uses: actions/checkout@v4
493+
- uses: actions/checkout@v5
494494

495495
- name: Set up Go
496-
uses: actions/setup-go@v5
496+
uses: actions/setup-go@v6
497497
with:
498498
go-version-file: 'go.mod'
499499
cache: true
@@ -555,16 +555,16 @@ jobs:
555555
- 6379:6379
556556

557557
steps:
558-
- uses: actions/checkout@v4
558+
- uses: actions/checkout@v5
559559

560560
- name: Set up Go
561-
uses: actions/setup-go@v5
561+
uses: actions/setup-go@v6
562562
with:
563563
go-version-file: 'go.mod'
564564
cache: true
565565

566566
- name: Set up Node.js
567-
uses: actions/setup-node@v4
567+
uses: actions/setup-node@v5
568568
with:
569569
node-version: '20'
570570

@@ -657,16 +657,16 @@ jobs:
657657
- 6379:6379
658658

659659
steps:
660-
- uses: actions/checkout@v4
660+
- uses: actions/checkout@v5
661661

662662
- name: Set up Go
663-
uses: actions/setup-go@v5
663+
uses: actions/setup-go@v6
664664
with:
665665
go-version-file: 'go.mod'
666666
cache: true
667667

668668
- name: Set up Node.js
669-
uses: actions/setup-node@v4
669+
uses: actions/setup-node@v5
670670
with:
671671
node-version: '20'
672672

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,18 @@ jobs:
1515
runs-on: ubuntu-latest
1616

1717
steps:
18-
- uses: actions/checkout@v4
18+
- uses: actions/checkout@v5
1919
with:
2020
fetch-depth: 0
2121

2222
- name: Set up Go
23-
uses: actions/setup-go@v5
23+
uses: actions/setup-go@v6
2424
with:
2525
go-version-file: 'go.mod'
2626
cache: true
2727

2828
- name: Set up Node.js
29-
uses: actions/setup-node@v4
29+
uses: actions/setup-node@v5
3030
with:
3131
node-version: '20'
3232
cache: 'npm'
@@ -117,7 +117,7 @@ jobs:
117117
contents: write
118118

119119
steps:
120-
- uses: actions/checkout@v4
120+
- uses: actions/checkout@v5
121121
with:
122122
ref: main
123123

‎cmd/benchmark/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -391,7 +391,7 @@ func parseBenchmarkOutput(output string) []BenchmarkResult {
391391
// Шаблон: BenchmarkName-N iterations ns/op B/op allocs/op.
392392
re := regexp.MustCompile(`(Benchmark\w+)(?:-\d+)?\s+(\d+)\s+([\d.]+)\s+ns/op(?:\s+([\d.]+)\s+B/op)?(?:\s+(\d+)\s+allocs/op)?`)
393393

394-
for _, line := range strings.Split(output, "\n") {
394+
for line := range strings.SplitSeq(output, "\n") {
395395
matches := re.FindStringSubmatch(line)
396396
if len(matches) >= 4 {
397397
nsOp, _ := strconv.ParseFloat(matches[3], 64)

‎docker/api/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@ COPY web/ ./
1616
RUN npm run build
1717

1818
# Dependencies caching stage
19-
FROM golang:1.25-alpine AS deps
19+
FROM golang:1.26-alpine AS deps
2020

2121
WORKDIR /deps
2222
COPY go.mod go.sum ./
2323
RUN go mod download
2424

2525
# Go build stage
26-
FROM golang:1.25-alpine AS builder
26+
FROM golang:1.26-alpine AS builder
2727

2828
# Install build dependencies
2929
RUN apk add --no-cache git make

‎docker/migrate/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Go build stage
2-
FROM golang:1.25-alpine AS builder
2+
FROM golang:1.26-alpine AS builder
33

44
# Install build dependencies
55
RUN apk add --no-cache git

‎docker/worker/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
# Dependencies caching stage
2-
FROM golang:1.25-alpine AS deps
2+
FROM golang:1.26-alpine AS deps
33

44
WORKDIR /deps
55
COPY go.mod go.sum ./
66
RUN go mod download
77

88
# Build stage
9-
FROM golang:1.25-alpine AS builder
9+
FROM golang:1.26-alpine AS builder
1010

1111
# Install build dependencies
1212
RUN apk add --no-cache git make

‎docs/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ make benchmark # Бенчмарки
8888

8989
| Backend | Frontend | Инфраструктура |
9090
|---------|----------|----------------|
91-
| Go 1.25 | React 19 | PostgreSQL 15 |
91+
| Go 1.26 | React 19 | PostgreSQL 15 |
9292
| Chi Router | TypeScript | Redis 7 |
9393
| WebSocket | Tailwind CSS 4 | Docker |
9494
| JWT + RBAC | Zustand | Prometheus/Grafana/Loki |

‎go.mod‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/bmstu-itstech/tjudge
22

3-
go 1.25.9
3+
go 1.26.3
44

55
require (
66
github.com/DATA-DOG/go-sqlmock v1.5.2
@@ -29,8 +29,8 @@ require (
2929
go.opentelemetry.io/otel/trace v1.43.0
3030
go.uber.org/mock v0.6.0
3131
go.uber.org/zap v1.26.0
32-
golang.org/x/crypto v0.47.0
33-
golang.org/x/sync v0.19.0
32+
golang.org/x/crypto v0.50.0
33+
golang.org/x/sync v0.20.0
3434
golang.org/x/time v0.14.0
3535
)
3636

@@ -92,11 +92,11 @@ require (
9292
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
9393
go.uber.org/atomic v1.7.0 // indirect
9494
go.uber.org/multierr v1.10.0 // indirect
95-
golang.org/x/mod v0.31.0 // indirect
96-
golang.org/x/net v0.49.0 // indirect
97-
golang.org/x/sys v0.42.0 // indirect
98-
golang.org/x/text v0.33.0 // indirect
99-
golang.org/x/tools v0.40.0 // indirect
95+
golang.org/x/mod v0.34.0 // indirect
96+
golang.org/x/net v0.53.0 // indirect
97+
golang.org/x/sys v0.43.0 // indirect
98+
golang.org/x/text v0.36.0 // indirect
99+
golang.org/x/tools v0.43.0 // indirect
100100
google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 // indirect
101101
google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 // indirect
102102
google.golang.org/grpc v1.80.0 // indirect

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -226,26 +226,26 @@ go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
226226
go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
227227
go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
228228
go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
229-
golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
230-
golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
231-
golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
232-
golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
233-
golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
234-
golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
235-
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
236-
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
229+
golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
230+
golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
231+
golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
232+
golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
233+
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
234+
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
235+
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
236+
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
237237
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
238238
golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
239239
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
240240
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
241-
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
242-
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
243-
golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
244-
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
241+
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
242+
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
243+
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
244+
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
245245
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
246246
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
247-
golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
248-
golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
247+
golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
248+
golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
249249
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
250250
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
251251
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=

0 commit comments

Comments
 (0)