mirrors/distribution
0
0 Fork 0
mirror of https://github.com/distribution/distribution.git synced 2026-10-28 10:15:27 +08:00
Code Activity

build: bump Go to 1.26.10 in Dockerfiles

Browse Source 
Motivation: the Dockerfiles pin GO_VERSION=1.26.8, so release and edge
images are built with a Go toolchain that predates the 1.26.9 and 1.26.10
security releases (including a mime/multipart memory limit bypass and
crypto/x509 intermediate certificate distrust). Rebuilds still produce
go1.26.8 binaries because of the pin.

Approach: bump the GO_VERSION ARG from 1.26.8 to 1.26.10 in Dockerfile and
dockerfiles/{docs,git,lint,vendor}.Dockerfile, as was done for the previous
bump. The CI matrix in build.yml uses 1.26.x and needs no change. No source
changes. This does not cut a patch release; that is a maintainer decision.

Validation: Docker is not available on this machine, so I did not build the
images. I confirmed the golang:1.26.10-alpine tag exists on Docker Hub and
grepped that no other 1.26.8 pin remains. The change only alters a base
image tag; no Go code or tests are affected.

Report: https://github.com/distribution/distribution/issues/5040
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5-5 (via Claude Code)
This commit is contained in:
Pujitha Paladugu committed 2026-10-22 11:12:51 -07:00
1 parent b9a4745811
commit a22d72fb43
5 files changed
+5 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Dockerfile
+1 -1
View File
@@ -2,7 +2,7 @@
# GO_VERSION sets the version of the golang base image to use.
# It must be a supported tag in the docker.io/library/golang image repository.
ARG GO_VERSION=1.26.8
ARG GO_VERSION=1.26.10
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
# It must be a supported tag in the docker.io/library/alpine image repository
dockerfiles/docs.Dockerfile
+1 -1
View File
@@ -2,7 +2,7 @@
# GO_VERSION sets the version of the golang base image to use.
# It must be a supported tag in the docker.io/library/golang image repository.
ARG GO_VERSION=1.26.8
ARG GO_VERSION=1.26.10
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
# It must be a supported tag in the docker.io/library/alpine image repository
dockerfiles/git.Dockerfile
+1 -1
View File
@@ -2,7 +2,7 @@
# GO_VERSION sets the version of the golang base image to use.
# It must be a supported tag in the docker.io/library/golang image repository.
ARG GO_VERSION=1.26.8
ARG GO_VERSION=1.26.10
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
# It must be a supported tag in the docker.io/library/alpine image repository
dockerfiles/lint.Dockerfile
+1 -1
View File
@@ -2,7 +2,7 @@
# GO_VERSION sets the version of the golang base image to use.
# It must be a supported tag in the docker.io/library/golang image repository.
ARG GO_VERSION=1.26.8
ARG GO_VERSION=1.26.10
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
# It must be a supported tag in the docker.io/library/alpine image repository
dockerfiles/vendor.Dockerfile
+1 -1
View File
@@ -2,7 +2,7 @@
# GO_VERSION sets the version of the golang base image to use.
# It must be a supported tag in the docker.io/library/golang image repository.
ARG GO_VERSION=1.26.8
ARG GO_VERSION=1.26.10
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
# It must be a supported tag in the docker.io/library/alpine image repository