ROSAENG-61450 | chore: bump go.mod to 1.26.5 by amandahla · Pull Request #3388 · openshift/rosa

amandahla · 2026-07-17T17:57:38Z

PR Summary

Bump go.mod (and related pins) to Go 1.26.5 as the follow-up to #3366. Also drops deferred stdlib Snyk/govulncheck ignores fixed in Go >= 1.26.4.

Depends on: openshift/release#81830 (from: rosa-clients). Do not merge this until that release PR is in, or Prow may fail with go.mod requires go >= 1.26.5 (running go 1.26.3; GOTOOLCHAIN=local).

Also covers / supersedes: #3382 (Darkstar stdlib CVE bump to 1.26.4) — 1.26.5 includes those fixes.

Detailed Description of the Issue

#3366 aligned Dockerfiles on ubi9/go-toolset:1.26.5 but left go.mod at 1.26.3 so existing from: src jobs kept passing. After release wires rosa-clients, go.mod can move to 1.26.5.

Related Issues and PRs

Jira: ROSAENG-61450
Depends on: ROSAENG-61450: wire rosa-clients for openshift/rosa CI release#81830
Parent: ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 #3366
Fixes / supersedes: [Project Darkstar] ROSAENG-60658: Remediate CVE-2026-27145, CVE-2026-42504 in rosa #3382 (ROSAENG-60658 stdlib CVEs; we bump to 1.26.5 instead of 1.26.4)

Type of Change

Previous Behavior

go.mod / bingo / renovate Go constraint at 1.26.3; stdlib Snyk and govulncheck ignores deferred until Go >= 1.26.4. Dockerfiles already on go-toolset 1.26.5 from #3366.

Behavior After This Change

go.mod → 1.26.5
.bingo/*.mod → 1.26.5
renovate.json gomod.constraints.go → 1.26.5
Removed deferred stdlib entries from .snyk and .govulncheck-ignore.yaml
Dockerfiles / .ci-operator.yaml unchanged (already 1.26.x from ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 #3366)

How to Test (Step-by-Step)

Preconditions

Go 1.26.5 (e.g. mise exec go@1.26.5 -- …)
Prefer after openshift/release#81830 merges

Test Steps

mise exec go@1.26.5 -- bash -lc 'export GOTOOLCHAIN=auto && make fmt-check && make rosa && make lint && make test'
Optional: podman build -f Dockerfile.clients -t rosa-clients:local . then no-mount make rosa

Expected Results

Local checks pass; after release PR, Prow build/lint/test pass on go-toolset 1.26.5.

Proof of the Fix

Local: fmt-check, rosa, lint, test passed on Go 1.26.5
CodeRabbit (coderabbit --agent -t uncommitted): 0 findings
govulncheck source scan clean; binary still reports pre-existing GO-2026-5932 in golang.org/x/crypto (no fix available)

Breaking Changes

No breaking changes
Yes, this PR introduces a breaking change (describe impact and migration plan below)

Developer Verification Checklist

Made with Cursor

Summary by CodeRabbit

Chores
- Updated the project’s Go toolchain requirement to 1.26.5.
- Aligned related development tooling configurations to use the same Go version.
Security
- Removed previously configured vulnerability suppressions so those findings can be reported again (including govulncheck and Snyk).

openshift-ci · 2026-07-17T17:57:43Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2026-07-17T17:58:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amandahla

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [amandahla]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-07-17T17:58:03Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 699e3fea-50ee-4ba4-ba35-7305faffe83d

📥 Commits

Reviewing files that changed from the base of the PR and between 0431ecf and 7f10cfd.

📒 Files selected for processing (11)

.bingo/bingo.mod
.bingo/gci.mod
.bingo/go-bindata.mod
.bingo/golangci-lint.mod
.bingo/goreleaser.mod
.bingo/govulncheck.mod
.bingo/mockgen.mod
.govulncheck-ignore.yaml
.snyk
go.mod
renovate.json

💤 Files with no reviewable changes (1)

.snyk

🚧 Files skipped from review as they are similar to previous changes (8)

.bingo/mockgen.mod
.bingo/goreleaser.mod
.bingo/bingo.mod
.bingo/go-bindata.mod
.bingo/golangci-lint.mod
.bingo/govulncheck.mod
.bingo/gci.mod
renovate.json

📝 Walkthrough

Walkthrough

Updated the main Go module, seven .bingo tool modules, and Renovate’s Go constraint to Go 1.26.5. Removed the vulnerability suppressions from .govulncheck-ignore.yaml and .snyk.

Possibly related issues

openshift/rosa#3350: Removes the same obsolete .snyk ignore entries after upgrading Go.

Suggested reviewers: braetroutman, jerichokeyne

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, uses the required JIRA/type format, and matches the main Go version bump.
Description check	✅ Passed	All required template sections are present and filled with relevant context, related issues, and validation details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes Go version pins and ignore files; no test files or Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	No Ginkgo test code changed; this PR only updates Go version pins and ignore configs, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; diff is limited to Go/tooling version pins and ignore-file cleanup.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new or modified Ginkgo e2e tests are in the diff; only Go version/config files changed.
Topology-Aware Scheduling Compatibility	✅ Passed	Diff only updates Go version pins and removes vuln-ignore config; no deployment manifests, controllers, or scheduling logic changed.
Ote Binary Stdout Contract	✅ Passed	PR only changes version/ignore config files; no Go source or process-level stdout code was touched, so no stdout-contract regression is introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Diff only updates Go/tooling config and removes vuln ignores; no Ginkgo/e2e test files or network calls were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto	✅ Passed	PR only bumps Go/tooling versions and removes vuln ignores; no changed file adds weak crypto or insecure secret comparisons.
Container-Privileges	✅ Passed	Diff only updates Go version pins and vuln-ignore configs; no container/K8s manifests or privilege flags (privileged, hostPID, allowPrivilegeEscalation, root) appear.
No-Sensitive-Data-In-Logs	✅ Passed	Only Go version and vuln-ignore config files changed; no logging code or secrets/PII/tokens appear in the patch.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Follow-up to openshift#3366: align go.mod, bingo tool modules, and renovate Go constraint with ubi9/go-toolset 1.26.5 already used by Dockerfiles. Drop deferred stdlib Snyk and govulncheck ignores fixed in Go >= 1.26.4. Depends on openshift/release#81830 (from: rosa-clients) so Prow presubmits compile with go-toolset 1.26.5 instead of ocp/builder 1.26.3. Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com>

amandahla · 2026-07-29T17:30:19Z

/test security

amandahla · 2026-07-29T17:30:47Z

/test all

amandahla · 2026-07-29T17:37:00Z

Headsup: probably I'll need to create another PR in the release for using a specific dockerfile path instead of the one in the repo. :(
Reference:
terraform-redhat/terraform-provider-rhcs#1271
openshift/release#82637
lets see if security check pass

amandahla · 2026-07-30T16:04:04Z

/hold

amandahla · 2026-08-04T17:28:32Z

Ah I found out why security passed here, for rosa we dont have the "SNYK_PRE_EXECUTION_HOOK_CMD" so uses the vendor path in the repository and there are no errors related to the Go version used by the Security job. So, ready to be reviewed.
Anyway, I'll proceed with ROSAENG-62986 so both repos follows same standard.

/unhold

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 17, 2026

openshift-ci Bot added the dco-signoff: yes label Jul 17, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 17, 2026

amandahla marked this pull request as ready for review July 29, 2026 17:19

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 29, 2026

openshift-ci Bot requested review from BraeTroutman and jerichokeyne July 29, 2026 17:20

amandahla force-pushed the ROSAENG-61450-go-1.26.5 branch from 0431ecf to 7f10cfd Compare July 29, 2026 17:32

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 30, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 4, 2026

amandahla mentioned this pull request Aug 4, 2026

ROSAENG-64541 | fix: switch bingo tool modules #3447

Draft

23 tasks

Navigation Menu

Uh oh!

ROSAENG-61450 | chore: bump go.mod to 1.26.5 - #3388

ROSAENG-61450 | chore: bump go.mod to 1.26.5#3388
amandahla wants to merge 1 commit into
openshift:masterfrom
amandahla:ROSAENG-61450-go-1.26.5

amandahla commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

Walkthrough

Uh oh!

amandahla commented Jul 29, 2026

Uh oh!

amandahla commented Jul 29, 2026

Uh oh!

amandahla commented Jul 29, 2026 •

edited

Loading

Uh oh!

amandahla commented Jul 30, 2026

Uh oh!

amandahla commented Aug 4, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

amandahla commented Jul 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Detailed Description of the Issue

Related Issues and PRs

Type of Change

Previous Behavior

Behavior After This Change

How to Test (Step-by-Step)

Preconditions

Test Steps

Expected Results

Proof of the Fix

Breaking Changes

Developer Verification Checklist

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

openshift-ci Bot commented Jul 17, 2026

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

amandahla commented Jul 29, 2026

Uh oh!

amandahla commented Jul 29, 2026

Uh oh!

amandahla commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amandahla commented Jul 30, 2026

Uh oh!

amandahla commented Aug 4, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

amandahla commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

amandahla commented Jul 29, 2026 •

edited

Loading

amandahla commented Aug 4, 2026 •

edited by atlassian Bot

Loading