Files
Li Liu 9d441ec7cb build(deps): upgrade Go to 1.26.10 to fix CVE-2026-111943 (#54597)
## Summary

Fix the High-severity Go stdlib CVE reported by the daily image scan
(`milvusdb/milvus:master-20261021-d0ce73ca`).

| CVE | Component | Installed | Fixed | Severity |
|-----|-----------|-----------|-------|----------|
| CVE-2026-111943 | Go stdlib `crypto/x509` | v1.26.9 | 1.26.10 / 1.27.3
| High |

CVE-2026-111943: man-in-the-middle attacks via untrusted intermediate
certificates in `crypto/x509`, fixed in Go 1.26.10.

## Change scope

Bump the Go toolchain `1.26.9` -> `1.26.10`:

- `go.mod` / `pkg/go.mod` / `tests/go_client/go.mod`: `go 1.26.9` ->
`1.26.10`
- Builder images (build the `bin/milvus` copied into every runtime
image):
-
`build/docker/builder/cpu/{ubuntu22.04,ubuntu20.04,ubuntu24.04,amazonlinux2023,rockylinux9}/Dockerfile`
  - `build/docker/builder/gpu/{ubuntu22.04,ubuntu20.04}/Dockerfile`
  - `build/docker/meta-migration/builder/Dockerfile`
  - `build/rpm/setup-env.sh`
  - `tests/go_client/Dockerfile`
- `.github/workflows/mac.yaml`,
`.github/workflows/publish-krte-images.yaml`

## Runtime image coverage

This is a Go toolchain fix. The six published runtime Dockerfiles

(`build/docker/milvus/{ubuntu22.04,ubuntu20.04,amazonlinux2023,rockylinux9}`
and `gpu/{ubuntu22.04,ubuntu20.04}`) copy the same `bin/milvus` / `lib/`
outputs built by the above builder images, so bumping the shared builder
toolchain + `go.mod` covers every image. No per-Dockerfile OS-package
change is required and none is skipped.

`client/go.mod` is left unchanged (client library intentionally supports
older Go).

Auto-generated CVE fix (autonomous run).

Signed-off-by: Li Liu <li.liu@zilliz.com>

Signed-off-by: Li Liu <li.liu@zilliz.com>
2026-10-26 19:46:19 +08:00

95 lines
3.5 KiB
YAML

name: Mac Code Checker
# This workflow is triggered by manual dispatch.
on:
workflow_dispatch:
inputs:
branch:
description: 'Branch to run the workflow on'
required: true
default: 'master'
type: string
concurrency:
group: ${{ github.workflow }}-${{ github.event.inputs.branch || github.sha }}
cancel-in-progress: false
jobs:
mac:
name: Code Checker MacOS
runs-on: macos-15
timeout-minutes: 480
steps:
- name: Checkout
uses: actions/checkout@v2
with:
ref: ${{ github.event.inputs.branch || github.ref }}
- name: Setup Python environment
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install CMake 3.31.8
run: |
cmake --version || true
which cmake || true
if ! brew list cmake &>/dev/null; then
brew uninstall cmake -f
fi
curl -LO https://github.com/Kitware/CMake/releases/download/v3.31.8/cmake-3.31.8-macos-universal.tar.gz
tar -zxf cmake-3.31.8-macos-universal.tar.gz -C /tmp/
sudo mv /tmp/cmake-3.31.8-macos-universal/CMake.app /Applications/
sudo rm -f /usr/local/bin/cmake /usr/local/bin/cpack /usr/local/bin/ctest
sudo rm -f /opt/homebrew/bin/cmake /opt/homebrew/bin/cpack /opt/homebrew/bin/ctest
echo -e "\n=== Creating symlinks for CMake ==="
sudo ln -s /Applications/CMake.app/Contents/bin/cmake /usr/local/bin/cmake
sudo ln -s /Applications/CMake.app/Contents/bin/cpack /usr/local/bin/cpack
sudo ln -s /Applications/CMake.app/Contents/bin/ctest /usr/local/bin/ctest
CMAKE_MODULE_DIR="/Applications/CMake.app/Contents/share/cmake-3.31"
sudo ln -s "$CMAKE_MODULE_DIR" /usr/local/share/cmake-3.31
export PATH="/usr/local/bin:$PATH"
cmake --version
which cmake
- name: Setup Go environment
uses: actions/setup-go@v4
with:
go-version: '1.26.10'
cache: false
- name: Download Caches
uses: ./.github/actions/macos-cache-restore
- name: Code Check
env:
CCACHE_DIR: /var/tmp/ccache
CCACHE_COMPILERCHECK: content
CCACHE_COMPRESS: 1
CCACHE_COMPRESSLEVEL: 9
CCACHE_MAXSIZE: 1G
run: |
if [[ ! -d "/var/tmp/ccache" ]];then
mkdir -p /var/tmp/ccache
fi
brew install libomp ninja ccache pkg-config
BREW_PREFIX=$(brew --prefix)
# aws-sdk-cpp 1.11.750 had a packaging bug where Paginator.h was
# not installed (missing CMake install rule for pagination headers).
# Homebrew backported the fix with "rebuild 1", but the CI runner's
# formula may be stale. Run brew update first so we get the
# patched bottle.
brew update
brew install aws-sdk-cpp || brew upgrade aws-sdk-cpp
# Install llvm@17 explicitly as a stable version
brew install llvm@17
if [[ ! -d "${BREW_PREFIX}/opt/llvm" ]]; then
ln -s ${BREW_PREFIX}/opt/llvm@17 ${BREW_PREFIX}/opt/llvm
fi
pip3 install conan==2.25.1
make milvus
- name: Upload Cmake log
uses: actions/upload-artifact@v4
if: ${{ failure() }}
with:
name: cmake-log
path: cmake_build/CMakeFiles/*.log
- name: Save Caches
uses: ./.github/actions/macos-cache-save
if: github.event_name != 'pull_request'