Bump Go 1.24 -> 1.26 and align Alpine to 3.23

Fixes CVE-2026-31789 (OpenSSL libcrypto3/libssl3, Alpine 3.22 ships
3.5.5-r0; 3.23 ships 3.5.6-r0) and CVE-2025-68121 (Go crypto/tls session
resumption, fixed in 1.24.13 / 1.25.7 / 1.26.0-rc.3).

Refs CLC-2245.

Co-authored-by: Ona <no-reply@ona.com>

Author: geropl

.github/workflows/.test.yml

@@ -27,7 +27,7 @@ on:
         type: string
 
 env:
-  GO_VERSION: "1.24"
+  GO_VERSION: "1.26"
   SETUP_BUILDX_VERSION: "edge"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
 

.github/workflows/buildkit.yml

@@ -19,7 +19,7 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  GO_VERSION: "1.24"
+  GO_VERSION: "1.26"
   SETUP_BUILDX_VERSION: "edge"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   IMAGE_NAME: "ghcr.io/gitpod-io/buildkit"

Dockerfile

@@ -18,8 +18,8 @@ ARG AZURITE_VERSION=3.33.0
 ARG GOTESTSUM_VERSION=v1.9.0
 ARG DELVE_VERSION=v1.23.1
 
-ARG GO_VERSION=1.24
-ARG ALPINE_VERSION=3.22
+ARG GO_VERSION=1.26
+ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.6.1
 ARG BUILDKIT_DEBUG
 ARG EXPORT_BASE=alpine

frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.24
-ARG ALPINE_VERSION=3.22
+ARG GO_VERSION=1.26
+ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.6.1
 
 # xx is a helper for cross-compilation

go.mod

@@ -2,7 +2,7 @@ module github.com/moby/buildkit
 
 go 1.24.0
 
-toolchain go1.24.4
+toolchain go1.26.2
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0