Repository navigation
Sync version/0-48-2-RC1 with beta; fix CI blockers - #3865
Merged
Merged
Conversation
With an empty diff, grep -v exits 1 and set -e aborts the script with no output, so a PR that changes nothing (e.g. merging beta into a version branch) fails Check Format on every OS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The CI Trivy scan fails on 13 Go stdlib CVEs (fixed in 1.26.9/1.26.10) and 11 golang.org/x/net findings (fixed in v0.60.0) published since the 0.48.1 scan. Re-vendored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
icanhasmath
changed the title
The tests compared a generated keypair with the same key parsed back from PEM using deep struct equality, which also compares rsa.PrivateKey's precomputed internals. Under Go 1.26.10 those can differ (e.g. a leading zero byte in dP) even though the keys are identical, so the tests failed intermittently. Compare with rsa.PrivateKey.Equal instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MDrakos
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gets
version/0-48-2-RC1ready for #3864 (0.48.2-RC1 → beta).Merge
betain.betahas one commit the version branch lacks: the merge commit for Version/0 48 1 rc4 #3856 (0.48.1-RC4). It changes no files, but without it 0.48.2-RC1 #3864 is BEHIND. mitchell did the same for RC4 ("Merge branch 'beta' into version/0-48-1-RC4").check-format fix (CI only). When a PR into a branch other than master changes no files,
grep -vexits 1 on the empty diff andset -eaborts the script with no output. This PR hit that on every OS. The fix is|| true.Go 1.26.6 → 1.26.10 and
golang.org/x/netv0.58.0 → v0.60.0. The Scan job (Trivy) failed on 14 CVEs published since the 0.48.1 scan: 13 in the Go standard library and 11 inx/net. Scan gates Deploy, so the push tobetawould also fail to stage without this. It follows mitchell's last bump (d3c9869): thegoline ingo.mod, thebuild.ymlmatrix,go getand re-vendor. A Security line is added to the 0.48.2 changelog.Keypair tests compare keys by value. Go 1.26.10 made
internal/keypairstests fail intermittently on Linux. They compared a generated*rsa.PrivateKeywith the same key parsed back from PEM using deep struct equality, which includes precomputed internals (a leading zero byte indPdiffered). The tests now usersa.PrivateKey.Equal. 20 consecutive runs pass on Go 1.26.10; before, it failed about 1 run in 3. This is a test-only change.Verified locally:
go build ./cmd/...passes with Go 1.26.10. Trivy 0.70.0 with CI's--ignore-unfixedreports 0 findings on the builtstatebinary. Without--ignore-unfixedit reports one, GO-2026-5932 (x/crypto/openpgp is unmaintained), which has no fixed version.Also on this PR:
macos-latestfailed once on the flakypkg/sysinfoTestPerformance timing test and passed on re-run.Merge with "Create a merge commit", not squash. A squash adds no ancestry, so #3864 would still be BEHIND.