Repository navigation
chore(deps): update docker.io/library/golang docker tag to v1.27.2 - #5483
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
![botantler-1[bot]](https://avatars.githubusercontent.com/in/1025824?s=60&v=4){kind=small}
…ci-lint golangci-lint v2.11.4 cannot read Go 1.27 export data, so the reports controller build fails once the builder moves to golang 1.27. v2.13.0 is the first release with go1.27 support; pin v2.13.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adapted this Renovate PR and took it out of the merge queue first (now a draft, auto-merge off).
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
v2.13.2 still failed: its golang.org/x/tools v0.49.0 reads pkgbits only up to V4, while Go 1.27.2 writes V5. x/tools v0.50.0 added V5 (golangci-lint v2.14.0+); pin the latest release, v2.15.0 (x/tools v0.52.0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Correction to my previous comment: v2.13.2 was not enough. The golang.org/x/tools v0.49.0 in v2.13.x reads pkgbits only up to V4, and Go 1.27.2 writes V5. x/tools v0.50.0 added V5, and golangci-lint v2.14.0 and later include it. 59c7f89 pins v2.15.0, the latest release, which uses x/tools v0.52.0. |
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Unparked 2026-11-01. #5492 is implemented at 23c4ba5: the lint gate now covers only the lines the hotfix patch changes. This head is agent-adapted, so it needs CI and a fresh review before promotion, then a head-pinned merge through the queue. Evidence is on #5492. Earlier blocker, kept for the record: 12 findings in upstream Kyverno source at 59c7f89. |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Release review, golang builder 1.26.9 to 1.27.2, and golangci-lint v2.11.4 to v2.15.0. Read from the Go 1.27 release notes and the golangci-lint changelog. I did not read the 1.27.1 and 1.27.2 point release notes.
No workaround becomes removable, and there is nothing to adopt. Not run on a real cluster. A merge publishes a new image. No manifest in this repository references that image at this head, so the merge alone does not change what the cluster runs. platform#5546 also edits this Dockerfile and asserts a Go 1.26 build, so it must be reconciled with this builder when it re-enters. |
devantler
left a comment
devantler
left a comment
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)
Reviewed commit: 23c4ba5c4e0d162b89446c3e5e586a2277a5c148
- CodeRabbit: it does not review bot-authored PRs, and its replies on platform#5596 at 04:16:46Z and 04:21:33Z report the included review limit as reached.
- Codex: usage limit since 2026-10-31T17:59:28Z (review-lane-health at about 04:05Z). Only the maintainer can lift it.
- Cursor Bugbot: usage limit since 2026-10-31T17:23:28Z (review-lane-health at about 04:05Z). Only the maintainer can lift it.
The patch copy runs after the source tree check in both jobs, and it reaches only the builder stage: the final image copies the binary alone. Local runs with planted findings are recorded on #5492. Verify reports controller passes at this head on the real builder. The release review is on this PR.
Verdict: no P0/P1 findings
Supplemental release review at Sources: Go release history, the 1.27.2 security announcement, and every commit subject in 1.27.0…1.27.1 (15 commits) and 1.27.1…1.27.2 (46). The existing major-release and linter review remains separate.
One newer security requirement remains: GO-2026-6809 identifies 1.27.2 as preceding the x509 fix in 1.27.3; the maintained 1.26 line is fixed in 1.26.10. Existing Security issue #5545 and draft #5546 already cover the patched runtime and actual-compiler proof, so no duplicate issue was opened. When reconciling that draft with this PR, preserve a patched compiler: retain 1.26.10 or use at least 1.27.3, and update its exact compiler assertion consistently. This is source/range evidence. It establishes neither executable reachability nor publication or deployment safety, and does not clear #5545's audit and adoption gates. |
Post-merge publication verified for merged source
This completes the carried publication check. Runtime adoption and security acceptance remain tracked by #5545 and #5546; they are still open. No deployment or security-remediation result is claimed here. |
This PR contains the following updates:
1.26.9-bookworm→1.27.2-bookworm1.27.3-bookwormWarning
Some dependencies could not be looked up. Check the warning logs for more information.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.