From 1157805146eb61e5a968b409ac29d53b73cac0c1 Mon Sep 17 00:00:00 2001 From: Maurice Date: Sun, 11 Oct 2026 21:33:32 +0200 Subject: [PATCH] build(docker): build gosu with Go 1.26 Go 1.25.14 carries ten stdlib CVEs that Docker Scout fails the image on; 1.26.9 fixes them. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 12a433b11..68c47f0d2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ # Rebuild gosu with a current Go toolchain so the runtime image ships no stale # Go stdlib (Debian's apt gosu is built with an old Go that trips CVE scanners). # The binary and its runtime behaviour are identical to the apt package. -FROM golang:1.25-alpine AS gosu-build +FROM golang:1.26-alpine AS gosu-build # Pinned to the commit of gosu's 1.19 tag: @latest made every build pick up whatever # was pushed last, and the tag itself is not a semver version go install accepts. RUN CGO_ENABLED=0 GOBIN=/out go install github.com/tianon/gosu@6456aaa0f3c854d199d0f037f068eb97515b7513