Skip to content

build: update to Go 1.26 - #390

Draft
Sahilb315 wants to merge 2 commits into
mainfrom
deps/#201-update-go-1.26
Draft

build: update to Go 1.26#390
Sahilb315 wants to merge 2 commits into
mainfrom
deps/#201-update-go-1.26

Conversation

@Sahilb315

@Sahilb315 Sahilb315 commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Summary

  • update the root and scripts modules to Go 1.26
  • refresh direct and transitive dependencies
  • make the Malysis analyzer test stub resilient to generated gRPC client interface additions

Root cause

The refreshed SafeDep API dependency added internal RPCs to MalwareAnalysisServiceClient. The hand-written analyzer test stub implemented the full generated interface explicitly, so unrelated API additions broke compilation. Embedding the generated interface keeps the stub focused on overriding QueryPackageAnalysis.

Closes #201

Validation

  • go test ./analyzer/ -count=1
  • go build ./...
  • git diff --check

The repository-wide test run was interrupted after the unrelated packagemanager package did not finish within 235 seconds; all packages reported before it passed.

@github-actions

github-actions Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown

vet Summary Report

This report is generated by vet

Policy Checks

  • ✅ Vulnerability
  • ✅ Malware
  • ❌ License
  • ❌ Popularity
  • ❌ Maintenance
  • ✅ Security Posture
  • ✅ Threats

Malicious Package Analysis

Malicious package analysis was performed using SafeDep Cloud API

Malicious Package Analysis Report
Ecosystem Package Version Status Report
ECOSYSTEM_GO github.com/google/go-querystring 1.2.0 ✅ 🔗
ECOSYSTEM_GO github.com/sagikazarmark/locafero 0.12.0 ✅ 🔗
ECOSYSTEM_GO sigs.k8s.io/yaml 1.6.0 ✅ 🔗
ECOSYSTEM_GO github.com/spf13/cobra 1.10.2 ✅ 🔗
ECOSYSTEM_GO github.com/golang-jwt/jwt/v5 5.3.1 ✅ 🔗
ECOSYSTEM_GO github.com/clipperhouse/uax29/v2 2.7.0 ✅ 🔗
ECOSYSTEM_GO github.com/go-viper/mapstructure/v2 2.5.0 ✅ 🔗
  • ℹ️ 7 packages have been actively analyzed for malicious behaviour.
  • ✅ No malicious packages found.

Note: Some of the package analysis jobs may still be running.Please check back later. Consider increasing the timeout for better coverage.

Changed Packages

Changed Packages

  • ✅ [Go] go.yaml.in/yaml/v2@2.4.4
  • ⚠️ [Go] github.com/sagikazarmark/locafero@0.12.0
  • ✅ [Go] github.com/elazarl/goproxy@1.8.5
  • ✅ [Go] github.com/zalando/go-keyring@0.2.8
  • ✅ [Go] github.com/posthog/posthog-go@1.21.0
  • ✅ [Go] buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@1.36.11-20260709200747-435963d16310.1
  • ✅ [Go] stdlib@1.26
  • ✅ [Go] github.com/golang-jwt/jwt/v5@5.3.1
  • ✅ [Go] golang.org/x/sys@0.47.0
  • ⚠️ [Go] github.com/goccy/go-json@0.10.6
  • ⚠️ [Go] github.com/danieljoos/wincred@1.2.3
  • ✅ [Go] github.com/fsnotify/fsnotify@1.10.1
  • ✅ [Go] github.com/caarlos0/env/v11@11.4.1
  • ✅ [Go] github.com/mattn/go-isatty@0.0.23
  • ⚠️ [Go] github.com/clipperhouse/uax29/v2@2.7.0
  • ⚠️ [Go] github.com/go-viper/mapstructure/v2@2.5.0
  • ✅ [Go] github.com/fatih/color@1.19.0
  • ✅ [Go] golang.org/x/text@0.40.0
  • ✅ [Go] golang.org/x/net@0.57.0
  • ✅ [Go] github.com/spf13/cobra@1.10.2
  • ✅ [Go] github.com/godbus/dbus/v5@5.2.2
  • ✅ [Go] github.com/mattn/go-colorable@0.1.15
  • ✅ [Go] github.com/klauspost/compress@1.19.1
  • ✅ [Go] github.com/go-playground/validator/v10@10.30.3
  • ✅ [Go] buf.build/gen/go/safedep/api/protocolbuffers/go@1.36.11-20260722054803-f24d8ff61049.1
  • ✅ [Go] github.com/pelletier/go-toml/v2@2.4.3
  • ✅ [Go] buf.build/gen/go/safedep/api/grpc/go@1.6.2-20260722054803-f24d8ff61049.1
  • ✅ [Go] golang.org/x/term@0.45.0
  • ✅ [Go] github.com/mattn/go-runewidth@0.0.24
  • ✅ [Go] github.com/jedib0t/go-pretty/v6@6.8.3
  • ✅ [Go] github.com/package-url/packageurl-go@0.1.6
  • ⚠️ [Go] go.uber.org/zap@1.28.0
  • ✅ [Go] golang.org/x/mod@0.38.0
  • ✅ [Go] google.golang.org/genproto/googleapis/rpc@0.0.0-20260720211330-0afa2a65878a
  • ✅ [Go] golang.org/x/sync@0.22.0
  • ✅ [Go] golang.org/x/crypto@0.54.0
  • ✅ [Go] github.com/landlock-lsm/go-landlock@0.9.0
  • ✅ [Go] github.com/andybalholm/brotli@1.2.2
  • ⚠️ [Go] github.com/safedep/dry@0.0.0-20260722071734-21a71cf9d6e3
  • ⚠️ [Go] github.com/google/go-querystring@1.2.0
  • ⚠️ [Go] sigs.k8s.io/yaml@1.6.0
  • ⚠️ [Go] kernel.org/pub/linux/libs/security/libcap/psx@1.2.78
  • ✅ [Go] modernc.org/sqlite@1.54.0
  • ✅ [Go] al.essio.dev/pkg/shellescape@1.6.0
  • ✅ [Go] modernc.org/libc@1.74.3
Policy Violations

Packages Violating Policy

[Go] github.com/sagikazarmark/locafero@0.12.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component popularity is low by Github stars count
  • ⚡ Use an alternative package that is popular

[Go] github.com/goccy/go-json@0.10.6 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/danieljoos/wincred@1.2.3 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/clipperhouse/uax29/v2@2.7.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/go-viper/mapstructure/v2@2.5.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] go.uber.org/zap@1.28.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/safedep/dry@0.0.0-20260722071734-21a71cf9d6e3 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component popularity is low by Github stars count
  • ⚡ Use an alternative package that is popular

[Go] github.com/google/go-querystring@1.2.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] sigs.k8s.io/yaml@1.6.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] kernel.org/pub/linux/libs/security/libcap/psx@1.2.78 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Risky OSS license was detected

@Sahilb315 ChatGPT Codex Connector

Sahilb315 commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

This dependency update is currently blocked by a Go 1.26 compatibility issue in github.com/elazarl/goproxy.

Go 1.26 made net/url.Parse reject malformed host components containing additional colons. During MITM handling, goproxy can reconstruct an absolute-form request as:

https://registry.npmjs.org:443http://registry.npmjs.org:443/...

Previous Go versions parsed this value permissively, after which PMG’s normalizeRequestURL repaired it. Go 1.26 returns an error and a nil URL instead. goproxy retains that parsing error and aborts the request before PMG’s handler can recover it, causing the proxy tests to fail on both Linux and macOS.

This behavior remains present in goproxy v1.8.5 and its current master. Its go 1.23 directive is not itself a problem—it specifies the minimum supported Go version, not a maximum.

We could temporarily set GODEBUG=urlstrictcolons=0, but that would globally disable a Go 1.26 URL security hardening, which is undesirable for PMG. The safer path is to patch goproxy and use the patched release or commit before completing this dependency update.

Failing CI run: https://github.com/safedep/pmg/actions/runs/29912869171

@Sahilb315

Sahilb315 commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

One dependency constraint to note:

  • gRPC needs to remain pinned to v1.81.0. With v1.82.0 and v1.82.1, PMG analyzer calls fail with rpc error: code = Internal desc = server closed the stream without sending trailers. The same Go 1.26 build works with v1.81.0.
  • goproxy remains on v1.8.5 for now. Once goproxy publishes a release containing the fix from elazarl/goproxy#793, we should update the dependency and remove the local URL normalization workaround and its tests.

@Sahilb315 Sahilb315 mentioned this pull request Jul 27, 2026
Merged
abhisek pushed a commit that referenced this pull request Jul 27, 2026
@Sahilb315
fix(container): cut image vulnerabilities with x dep bumps and base i…
d9240ee 
…mage refresh (#394)

* fix(deps): update golang.org/x modules to latest on the Go 1.25 line

Clears the x/crypto, x/net, x/sys and x/text vulnerability findings
reported against the pmg binary by image scanners.

Deliberately kept back: the go directive stays 1.25.1 because the Go
1.26 move is blocked on goproxy URL parsing (see #390), and grpc stays
pinned at v1.81.0 due to the trailers regression with v1.82.x.

* fix(container): move runtime base to debian 13 and refresh builder pin

The bullseye runtime base and the stale golang:1.25-bookworm digest
(go1.25.5) accounted for most of the vulnerability findings in the
published image. debian:13-slim is current stable and the refreshed
golang digest carries go1.25.12, covering every flagged stdlib CVE.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Upgrade PMG to Go 1.26

1 participant

@Sahilb315