Repository navigation
chore: bump Go to 1.26.10 [release/0.10] - #1916
Merged
Merged
Conversation
Security advisory: a compromised certificate authority. Bump the Go toolchain in go.mod, Dockerfiles and CI workflows. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 32cc1f50c6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…60.0 golangci-lint v2.4.0 is built with Go 1.25 and refuses to lint a Go 1.26 module. x/net v0.60.0 fixes GO-2026-6617 and related govulncheck findings. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
arnaubennassar
approved these changes
Oct 21, 2026
Preallocate slices (prealloc) and annotate bounded indexes that gosec G602 flags as out of range. No behaviour change. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Requesting to merge despite the failing "Run Go E2E Tests" check. Why the failing check is not related to this change
What did pass on this PRlint (golangci-lint v2.9.0, 0 issues), govulncheck (golang.org/x/net bumped to v0.60.0), unit tests (Go 1.26.10), CodeQL, Docker image build, and the OP pessimistic 2-chain E2E. [Update this list once the remaining Kurtosis E2E jobs finish.] Follow-upThe Go E2E environment on release/0.10 needs a separate investigation (tracked outside this PR). |
arnaubennassar
added a commit
that referenced
this pull request
Oct 28, 2026
## 🔄 Changes Summary - Bump Go from `1.26.9` to the latest stable release, `1.27.3` (per https://go.dev/dl). - `go.mod`: `go 1.26.0 -> 1.27.0` and `toolchain go1.26.9 -> go1.27.3`. `go mod tidy` produces no dependency changes. - `Dockerfile` / `Dockerfile.debug`: builder image `golang:1.27.3-alpine`. - CI pins aligned to `1.27.3`: `test-unit`, `lint`, `codeql`, `govulncheck`, `test-e2e`, `test-go-e2e`, `test-e2e-exit_cenrtificate_tool` (`govulncheck` was still on `1.25.7`). - `lint`: `golangci-lint` `v2.14.0 -> v2.15.0`. `v2.14.0` is built with Go 1.26 and refuses to lint a `go1.27` module; `v2.15.0` is built with Go 1.27. - Fix two `%w` wraps of `*GRPCError` flagged by the new Go 1.27 `printf` vet check (`GRPCError` implements `error` on a value receiver, so wrapping the pointer defeats `errors.Is`): - `grpc/client_test.go` - `aggsender/flows/builder_flow_aggchain_prover_test.go` ##⚠️ Breaking Changes - 🛠️ **Config**: None - 🔌 **API/CLI**: None - 🗑️ **Deprecated Features**: None ## 📋 Config Updates - 🧾 **Diff/Config snippet**: N/A ## 🔌 API Updates ### 🔌 Bridge service API - 🔌 **Bridge service API Update**: No endpoints modified, added or removed. No breaking interface change. ### 🔌 Proxy API - 🔌 **AProxy API Update**: No endpoints modified, added or removed. No breaking interface change. ### 🔌 Others API - 🔌 **Others API Update**: No endpoints modified, added or removed. No breaking interface change. ## ✅ Testing - 🤖 **Automatic**: CI runs unit, lint, govulncheck, codeql and e2e with `1.27.3`. Locally verified with `go1.27.3`: `go build ./...`, `go vet ./...` and `golangci-lint v2.15.0` are clean; full `go test -short -race ./...` passes except for three pre-existing flakes (see notes). - 🖱️ **Manual**: N/A ## 🐞 Issues - N/A ## 🔗 Related PRs - #1916 / #1917 (Go bumps on the `release/0.10` and `release/0.11` branches, which moved to `1.26.10`) ## 📝 Notes - Two pre-existing, version-independent test flakes showed up during local runs and also reproduce on `develop` with `go1.26.9`, so they are not caused by this bump: - `bridgeservicefinder/TestLiveDiscovery_AllowNetworkIDs` — data race between the test reading `f.addrToNetworkID` and `listener.discoverRollup` writing it (added in #1923). Reproduces ~1/5 runs on `develop` too. - `claimsync/TestClaimCalldata` — local geth docker container restart hiccup (`connection reset by peer`); passes on re-run. - `l2gersync/TestL2GERSync_IndexLegacyGERManagerSC` — timing dependent; passes on re-run. - The bump is to `1.27.3` rather than `1.26.10` used on the release branches because `1.27.3` is the latest stable release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔄 Changes Summary
release/0.10(go.mod,Dockerfile,Dockerfile.debugand CI workflows).✅ Testing
go build ./...passes with go1.26.10 locally; CI runs unit, lint, govulncheck and e2e with the new version.📝 Notes
🤖 Generated with Claude Code