Repository navigation
[CI] : Bump Go toolchain to 1.26.10 for eMudhra CA compromise - #689
Merged
Merged
Conversation
The eMudhra intermediate CA keys disclosed on 2026-10-20 are only handled in Go 1.26.10 and 1.27.3; there is no backport to 1.24 or 1.25. - go.mod: add `toolchain go1.26.10`. The `go 1.24` minimum is unchanged, so consumers aren't forced to upgrade. - CI: both jobs now read the Go version from go.mod (go-version-file), so the toolchain line is the single place to bump. Previously Test used ^1.18 (whatever Go was cached on the runner) and Lint was pinned to 1.24.
AJaccP
approved these changes
Oct 21, 2026
rishiy15
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
On 2026-10-20 the private keys of eight eMudhra intermediate CA certificates were disclosed. Go's fix is in 1.26.10 and 1.27.3, with no backport to 1.24 or 1.25.
This follows the same approach as 1Password/terraform-provider-onepassword#407:
go.mod: addstoolchain go1.26.10. Thego 1.24minimum is unchanged, so downstream consumers (including op) aren't forced to raise their Go version. Go ignores thetoolchainline when this module is a dependency.go-version-file: go.mod, and setup-go installs the version from thetoolchainline. Before this, the Lint job was pinned to1.24, which will never get the fix, and the Test job used^1.18, which could pick an older, unpatched Go cached on the runner.Not changed
flake.nix/flake.lock): the Go 1.26.10 bump in nixpkgs (NixOS/nixpkgs#576200) is still onstagingand hasn't reachednixpkgs-unstable. The weekly flake-update bot will pick it up once it lands. Until then the shell keeps working, because only thego 1.24line is required.Testing
On Go 1.26.10:
make testandmake validate: passgolangci-lintv2.12.2: 0 issuesgo mod tidy: no changesType of change
Related Issue(s)
None
How To Test
On Go 1.26.10:
make testandmake validate: passgolangci-lintv2.12.2: 0 issuesgo mod tidy: no changesChangelog
Bump Go toolchain to 1.26.10 for eMudhra CA compromise