mirror of
https://github.com/distribution/distribution.git
synced 2026-10-28 10:15:27 +08:00
Pujitha Paladugu
a22d72fb43
Motivation: the Dockerfiles pin GO_VERSION=1.26.8, so release and edge
images are built with a Go toolchain that predates the 1.26.9 and 1.26.10
security releases (including a mime/multipart memory limit bypass and
crypto/x509 intermediate certificate distrust). Rebuilds still produce
go1.26.8 binaries because of the pin.
Approach: bump the GO_VERSION ARG from 1.26.8 to 1.26.10 in Dockerfile and
dockerfiles/{docs,git,lint,vendor}.Dockerfile, as was done for the previous
bump. The CI matrix in build.yml uses 1.26.x and needs no change. No source
changes. This does not cut a patch release; that is a maintainer decision.
Validation: Docker is not available on this machine, so I did not build the
images. I confirmed the golang:1.26.10-alpine tag exists on Docker Hub and
grepped that no other 1.26.8 pin remains. The change only alters a base
image tag; no Go code or tests are affected.
Report: https://github.com/distribution/distribution/issues/5040
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5-5 (via Claude Code)