From 54eedce658c08e55f5badc5a8835d63c325dc22c Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Thu, 22 Oct 2026 11:36:48 +0000 Subject: [PATCH] all: build with Go 1.27.3 crypto/x509 security fixes. --- AGENTS.md | 4 ++-- CHANGELOG.md | 2 +- Dockerfile.integration | 2 +- Dockerfile.wasmclient | 2 +- cmd/hi/README.md | 2 +- cmd/hi/run.go | 4 ++-- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 6e7494fb3..86d33f3ff 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -66,7 +66,7 @@ similar lines of code is better than a premature abstraction. ## Quick Start ```bash -# Enter the nix dev shell (Go 1.27.2, buf, golangci-lint, prek) +# Enter the nix dev shell (Go 1.27.3, buf, golangci-lint, prek) nix develop # Full development workflow: fmt + lint + test + build @@ -93,7 +93,7 @@ go run ./tools/bump plan # what is stale, changes nothing go run ./tools/bump verify # do the pins still agree ``` -Go 1.27.2 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain +Go 1.27.3 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain used in CI. ## Pre-Commit with prek diff --git a/CHANGELOG.md b/CHANGELOG.md index e9e35593e..80804ab39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -127,7 +127,7 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`, - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341) - Fix `headscale users destroy`/`rename` reporting "multiple users match query" when no user matches; an ambiguous match now lists the matching users [#3476](https://github.com/juanfont/headscale/pull/3476) - Deleting a user that still owns nodes now lists the nodes (ID and hostname) that must be deleted first [#3475](https://github.com/juanfont/headscale/pull/3475) -- Headscale now requires Go 1.27 to build +- Headscale now requires Go 1.27.3 to build, which carries the `crypto/x509` security fixes [#3560](https://github.com/juanfont/headscale/pull/3560) - `headscale preauthkeys create --user` accepts a user name as well as an ID - `derp.paths` files may be Tailscale JSON or HuJSON DERP maps as well as YAML - `dns.extra_records_path` files may be HuJSON or YAML as well as JSON diff --git a/Dockerfile.integration b/Dockerfile.integration index ae65b5128..abbccd27f 100644 --- a/Dockerfile.integration +++ b/Dockerfile.integration @@ -2,7 +2,7 @@ # and are in no way endorsed by Headscale's maintainers as an # official nor supported release or distribution. -FROM docker.io/golang:1.27.2-trixie AS builder +FROM docker.io/golang:1.27.3-trixie AS builder ARG VERSION=dev ENV GOPATH /go WORKDIR /go/src/headscale diff --git a/Dockerfile.wasmclient b/Dockerfile.wasmclient index 8b7868d9f..131040b9f 100644 --- a/Dockerfile.wasmclient +++ b/Dockerfile.wasmclient @@ -7,7 +7,7 @@ # to drive a real browser-style WebSocket GET against headscale's /ts2021, # guarding the regression in issue #3357. -FROM golang:1.27.2-alpine AS build +FROM golang:1.27.3-alpine AS build WORKDIR /src diff --git a/cmd/hi/README.md b/cmd/hi/README.md index 50d5bff15..c6485b032 100644 --- a/cmd/hi/README.md +++ b/cmd/hi/README.md @@ -55,7 +55,7 @@ changing. | `--timeout` | `120m` | Total test timeout. Use the built-in flag — never wrap with bash `timeout`. | | `--postgres` | `false` | Use PostgreSQL instead of SQLite | | `--failfast` | `true` | Stop on first test failure | -| `--go-version` | auto | Detected from `go.mod` (currently 1.27.0) | +| `--go-version` | auto | Detected from `go.mod` (currently 1.27.3) | | `--test-binary` | unset | Execute a precompiled integration test binary instead of running `go test` | | `--clean-before` | `true` | Clean stale (stopped/exited) containers before starting | | `--clean-after` | `true` | Clean this run's containers after completion | diff --git a/cmd/hi/run.go b/cmd/hi/run.go index 8c3648125..c4d15edad 100644 --- a/cmd/hi/run.go +++ b/cmd/hi/run.go @@ -113,7 +113,7 @@ func detectGoVersion() string { if err != nil { content, err = os.ReadFile(filepath.Join("..", "..", "go.mod")) if err != nil { - return "1.27.0" + return "1.27.3" } } @@ -125,5 +125,5 @@ func detectGoVersion() string { } } - return "1.27.0" + return "1.27.3" }