fix: upgrade Go to 1.26.5 to resolve stdlib CVEs in gh-aw-mcpg container - #48453
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
🤖 PR Triage
CVE fix: upgrades Go to 1.26.5 resolving 1 Critical + 13 High stdlib CVEs in the gh-aw-mcpg container. Tiny change (6 adds, 2 dels, 3 files). Security urgency warrants fast-track once undrafted.
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR #48453 does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100). |
|
✅ Test Quality Sentinel completed test quality analysis. No test files were added or modified in this PR. This PR upgrades Go to 1.26.5 for CVE fixes in a container image; it contains only dependency and configuration changes. Test Quality Sentinel skipped. |
|
✅ PR Code Quality Reviewer completed the code quality review. |
There was a problem hiding this comment.
Pull request overview
Updates the gh-aw Go toolchain to 1.26.5, but does not remediate the separately built gh-aw-mcpg image.
Changes:
- Bumps the Go directive to 1.26.5.
- Adds a patch changeset.
- Refreshes one generated workflow lock file.
Show a summary per file
| File | Description |
|---|---|
go.mod |
Updates the gh-aw Go toolchain. |
.changeset/patch-upgrade-go-1-26-5.md |
Documents the version bump. |
.github/workflows/smoke-copilot-auto.lock.yml |
Removes obsolete generated model-cost metadata. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 2
- Review effort level: Medium
| module github.com/github/gh-aw | ||
|
|
||
| go 1.26.3 | ||
| go 1.26.5 |
| "gh-aw": patch | ||
| --- | ||
|
|
||
| Upgrade Go toolchain to 1.26.5 to resolve Critical and High Go stdlib vulnerabilities (CVEs) found in the `ghcr.io/github/gh-aw-mcpg` container image scanned at go1.26.3. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — clean security patch.
Go toolchain bump from 1.26.3 → 1.26.5 correctly addresses the reported stdlib CVEs. The lock file recompile dropping GH_AW_INFO_MODEL_COSTS is a legitimate auto-generated change. No logic errors, no correctness risks, no missing error handling in the diff.
🔎 Code quality review by PR Code Quality Reviewer · sonnet46 · 18.4 AIC · ⌖ 4.5 AIC · ⊞ 5.7K
Comment /review to run again
There was a problem hiding this comment.
Review: Go 1.26.5 Security Upgrade
Clean, minimal CVE fix — go.mod bumped from 1.26.3 → 1.26.5, changeset added, lock file auto-recompiled. No issues found.
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 14.3 AIC · ⌖ 5.17 AIC · ⊞ 5K
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /diagnosing-bugs — this is a surgical security patch with no actionable issues.
📋 Key Themes & Highlights
Positive Highlights
- ✅ Root cause addressed at the right level: Go version bump in
go.modpropagates automatically to all CI viago-version-file: go.mod— no hardcoded versions to chase down - ✅ Changeset entry correctly scoped as
patchwith clear CVE context for release notes - ✅ Auto-regenerated lock file (
smoke-copilot-auto.lock.yml) is included, keeping compiled outputs in sync - ✅ PR description enumerates severity (1 Critical + 13 High CVEs) and links to the tracking issue
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 21.2 AIC · ⌖ 4.54 AIC · ⊞ 6.7K
Comment /matt to run again
|
🎉 This pull request is included in a new release. Release: |
The
ghcr.io/github/gh-aw-mcpgcontainer built on Go 1.26.3 had 1 Critical and 13 High Go stdlib CVEs. Go 1.26.5 patches all of them.Changes
go.mod— bumpgo 1.26.3→go 1.26.5; all CI workflows usego-version-file: go.modso the next image build automatically picks up the patched stdlib.changeset/patch-upgrade-go-1-26-5.md— patch changeset for the version bump.github/workflows/smoke-copilot-auto.lock.yml— auto-regenerated bymake recompile