From 302427fa1d3aae720367a019317639a3c4f9ca74 Mon Sep 17 00:00:00 2001 From: Jannes Stubbemann Date: Tue, 25 Aug 2026 15:30:41 +0200 Subject: [PATCH 1/3] chore: bump Go to 1.26.6 govulncheck fails on every open PR with five stdlib vulnerabilities (GO-2026-6218, GO-2026-6090, GO-2026-6089, GO-2026-5972, GO-2026-5026) present in go1.26.5 and fixed in go1.26.6. CI resolves the toolchain from go.mod, so bumping the directive clears the check everywhere. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01FJnTGiMuTJSFUVRRqjfTbV --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 73df91f..540ebf6 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/paperclipinc/karpenter-provider-hetzner -go 1.26.5 +go 1.26.6 require ( github.com/awslabs/operatorpkg v0.0.0-20260708223819-4da4c353c5fa From af095fba90694ac84b12de0d121cb81de38b2f30 Mon Sep 17 00:00:00 2001 From: Jannes Stubbemann Date: Tue, 25 Aug 2026 15:33:28 +0200 Subject: [PATCH 2/3] fix(make): download the karpenter module before resolving its dir MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vendor-core-crds resolved the module directory with 'go list -m', which does not download the module. On a cold module cache — any PR that changes go.mod/go.sum misses the setup-go cache — .Dir is empty and the copy fails with cp: cannot stat '/pkg/apis/crds/...'. This is why the generate job failed on dependabot bumps. Download the module first and fail loudly if the dir still cannot be resolved. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01FJnTGiMuTJSFUVRRqjfTbV --- Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Makefile b/Makefile index e8fddd2..3ce2e9a 100644 --- a/Makefile +++ b/Makefile @@ -30,7 +30,9 @@ generate: vendor-core-crds # feature gates that default to false, and this chart does not expose them. vendor-core-crds: @set -eu; \ + go mod download sigs.k8s.io/karpenter; \ dir="$$(go list -m -f '{{.Dir}}' sigs.k8s.io/karpenter)"; \ + [ -n "$$dir" ] || { echo "sigs.k8s.io/karpenter not found in module cache" >&2; exit 1; }; \ for crd in karpenter.sh_nodepools.yaml karpenter.sh_nodeclaims.yaml; do \ cp "$$dir/pkg/apis/crds/$$crd" charts/karpenter-provider-hetzner/crds/$$crd; \ chmod u+w charts/karpenter-provider-hetzner/crds/$$crd; \ From 8d5ec4b75faa5dd0c80dad47b2dd214b77fe4702 Mon Sep 17 00:00:00 2001 From: Jannes Stubbemann Date: Tue, 25 Aug 2026 15:36:53 +0200 Subject: [PATCH 3/3] chore: bump to Go 1.26.7, pin builder image, record in CHANGELOG Review caught that 1.26.6 was already superseded by 1.26.7 within its minor line. Pin the Dockerfile builder to golang:1.26.7-alpine so the shipped binary is built with the toolchain CI tests with (official golang images set GOTOOLCHAIN=local, so a floating 1.26-alpine tag can lag go.mod and hard-fail the release build). Record both changes under [Unreleased]. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01FJnTGiMuTJSFUVRRqjfTbV --- CHANGELOG.md | 4 ++++ Dockerfile | 2 +- go.mod | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2c1cb62..04dbc8e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed +- Go toolchain bumped to 1.26.7 (from 1.26.5), clearing five stdlib vulnerabilities flagged by govulncheck (GO-2026-6218, GO-2026-6090, GO-2026-6089, GO-2026-5972, GO-2026-5026; all fixed by 1.26.6). The release image builder is pinned to `golang:1.26.7-alpine` so the shipped binary is built with the same toolchain CI tests with. Local builds now require Go >= 1.26.7. +- `make vendor-core-crds` downloads the `sigs.k8s.io/karpenter` module before resolving its directory, fixing `generate` CI failures on any PR that changes `go.mod`/`go.sum` (cold module cache made `go list -m` return an empty dir). + ## [2.1.0] - 2026-08-01 ### Fixed diff --git a/Dockerfile b/Dockerfile index 1796300..3ee632e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # Cross-compile from the native build platform to the target platform so multi-arch # builds don't run `go build` under slow QEMU emulation. -FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder +FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS builder ARG TARGETOS ARG TARGETARCH WORKDIR /app diff --git a/go.mod b/go.mod index 540ebf6..9ed3187 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/paperclipinc/karpenter-provider-hetzner -go 1.26.6 +go 1.26.7 require ( github.com/awslabs/operatorpkg v0.0.0-20260708223819-4da4c353c5fa