From a22d72fb434f383eaa5c4d0adb93e42bd8a43681 Mon Sep 17 00:00:00 2001
From: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Date: Thu, 22 Oct 2026 11:12:37 -0700
Subject: [PATCH] build: bump Go to 1.26.10 in Dockerfiles

Motivation: the Dockerfiles pin GO_VERSION=1.26.8, so release and edge
images are built with a Go toolchain that predates the 1.26.9 and 1.26.10
security releases (including a mime/multipart memory limit bypass and
crypto/x509 intermediate certificate distrust). Rebuilds still produce
go1.26.8 binaries because of the pin.

Approach: bump the GO_VERSION ARG from 1.26.8 to 1.26.10 in Dockerfile and
dockerfiles/{docs,git,lint,vendor}.Dockerfile, as was done for the previous
bump. The CI matrix in build.yml uses 1.26.x and needs no change. No source
changes. This does not cut a patch release; that is a maintainer decision.

Validation: Docker is not available on this machine, so I did not build the
images. I confirmed the golang:1.26.10-alpine tag exists on Docker Hub and
grepped that no other 1.26.8 pin remains. The change only alters a base
image tag; no Go code or tests are affected.

Report: https://github.com/distribution/distribution/issues/5040
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5-5 (via Claude Code)
---
 Dockerfile                    | 2 +-
 dockerfiles/docs.Dockerfile   | 2 +-
 dockerfiles/git.Dockerfile    | 2 +-
 dockerfiles/lint.Dockerfile   | 2 +-
 dockerfiles/vendor.Dockerfile | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 830b2b509..a856e8a48 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 
 # GO_VERSION sets the version of the golang base image to use.
 # It must be a supported tag in the docker.io/library/golang image repository.
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.10
 
 # ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
 # It must be a supported tag in the docker.io/library/alpine image repository
diff --git a/dockerfiles/docs.Dockerfile b/dockerfiles/docs.Dockerfile
index b54f2e0b3..5115925ba 100644
--- a/dockerfiles/docs.Dockerfile
+++ b/dockerfiles/docs.Dockerfile
@@ -2,7 +2,7 @@
 
 # GO_VERSION sets the version of the golang base image to use.
 # It must be a supported tag in the docker.io/library/golang image repository.
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.10
 
 # ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
 # It must be a supported tag in the docker.io/library/alpine image repository
diff --git a/dockerfiles/git.Dockerfile b/dockerfiles/git.Dockerfile
index 51bcd7955..7c229da85 100644
--- a/dockerfiles/git.Dockerfile
+++ b/dockerfiles/git.Dockerfile
@@ -2,7 +2,7 @@
 
 # GO_VERSION sets the version of the golang base image to use.
 # It must be a supported tag in the docker.io/library/golang image repository.
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.10
 
 # ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
 # It must be a supported tag in the docker.io/library/alpine image repository
diff --git a/dockerfiles/lint.Dockerfile b/dockerfiles/lint.Dockerfile
index b8184441b..27940be5c 100644
--- a/dockerfiles/lint.Dockerfile
+++ b/dockerfiles/lint.Dockerfile
@@ -2,7 +2,7 @@
 
 # GO_VERSION sets the version of the golang base image to use.
 # It must be a supported tag in the docker.io/library/golang image repository.
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.10
 
 # ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
 # It must be a supported tag in the docker.io/library/alpine image repository
diff --git a/dockerfiles/vendor.Dockerfile b/dockerfiles/vendor.Dockerfile
index e35ede86f..050ae8e83 100644
--- a/dockerfiles/vendor.Dockerfile
+++ b/dockerfiles/vendor.Dockerfile
@@ -2,7 +2,7 @@
 
 # GO_VERSION sets the version of the golang base image to use.
 # It must be a supported tag in the docker.io/library/golang image repository.
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.10
 
 # ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
 # It must be a supported tag in the docker.io/library/alpine image repository