[sjmiller609]

Summary

• Require Go 1.26.10 for server builds and align CI, Linux/macOS releases, builder agents and development/source-install bootstrap pins.
• This release includes the CVE-2026-111943 certificate-chain mitigation. Embedded Caddy, guest-agent and init binaries are rebuilt by the existing release preparation.
• Read Go from go.mod in all seven setup-go steps, including SDK generation, instead of duplicating pins or floating on stable.
• Fix the development bootstrap's version guard and PATH ordering; download before replacing an old Go installation. Update the three development-documentation version references.
• Keep standalone Docker/bootstrap/CloudFormation pins explicit rather than add version-plumbing machinery.

Validation

• Passed go build -tags containers_image_openpgp ./....
• Passed targeted short tests for lib/ingress/..., lib/system/... and deploy/aws/cloudformation.
• Rebuilt Caddy for amd64/arm64 and the embedded Linux guest-agent/init; verified Caddy uses Go 1.26.10.
• Follow-up validation passed: shell syntax, five mocked bootstrap scenarios (old/current/newer/missing Go and failed download), setup-go/YAML consistency checks, actionlint with the existing custom kvm runner label accepted, and CloudFormation Go tests.
• Full hypervisor integration tests, macOS builds, full builder-image builds, SDK generation and cfn-lint were not run locally for this follow-up.

Rollout

Release/rebuild and deploy after merging, with the infrastructure toolchain/trust updates. No running hosts or services were changed.

---

Note

Medium Risk
Toolchain-wide Go upgrade affects all builds, releases, and bootstrap paths; CI alignment reduces drift but embedded binaries still need release rebuild after merge.

Overview
Bumps the module and build toolchain to Go 1.26.10 (including the CVE-2026-111943 certificate-chain fix) and makes go.mod the single source of truth for CI: every actions/setup-go step now uses go-version-file: go.mod instead of duplicated pins or stable.

Explicit 1.26.10 pins remain where Actions does not read go.mod—the generic builder Dockerfile, AWS CloudFormation branch-install curl, and scripts/utm/bootstrap-dev-environment.sh, which also fixes Go detection (GOTOOLCHAIN=local go env GOVERSION), downloads to a temp file before replacing /usr/local/go, and prepends /usr/local/go/bin on PATH. DEVELOPMENT.md prerequisite text is updated to Go 1.26.10+.

^{Reviewed by Cursor Bugbot for commit ff894c3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chruffins]

Bugs

• scripts/utm/bootstrap-dev-environment.sh:52 — the guard grep -q "go1.2" matches go1.25.4, so machines that already have a 1.2x toolchain skip the install and never reach the new GO_VERSION on line 55. compare the installed version against GO_VERSION before skipping. the guard predates this PR, but the bump is what it needs to deliver.

Questions

• .github/actions/setup-stlc/action.yml:20 — go-version: "stable" floats and is not pinned. is SDK generation meant to be in the 1.26.10 alignment scope? this line is not in the diff.

Structural / Maintainability

• .github/workflows/test.yml:92 — the same version is hand-written in ten places: six workflow pins, go.mod, the builder Dockerfile, the CloudFormation download, and the bootstrap script. this duplication predates the PR. vuln-remediation.yml:16 already uses go-version-file: 'go.mod', so the workflows could follow it. suggested as a follow-up, not a blocker.

Nits

• DEVELOPMENT.md:9, :19, :371 — still say "Go 1.25.4+". update them to 1.26.10+.

coverage — all 7 changed files inspected. repo-wide grep found no other executable 1.25 pins; remaining hits are test fixtures (golang:1.21, golang:1.22 examples) and unrelated text. go1.26.10 is present in the go.dev release index, and the Dockerfile and tarball names are correct. not verified: the CVE-2026-111943 mitigation claim, rebuilt Caddy/guest-agent/init binaries, macOS builds, full builder-image builds, cfn-lint.
status: review complete; read-only analysis; no tests run

[github-actions]

-->

✱ stlc build

✅ go code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

116 files generated at ebc828a (pushed)

go get github.com/kernel/hypeman-go-staging@ebc828aaf658a6f0bff6a77200967b1b842cfe76

✅ python code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

232 files generated at 92b2a5a (pushed)

✅ typescript code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

138 files generated at f8d0146 (pushed)

Diagnostics: ❗ 0 new / 1 total error, 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_76bCqZdy-gleaming-pony
Timestamp	2026-10-21T12:57:01.328Z
stlc	8413509
Spec hash	347a7be06316
Config hash	659c3687c3f0

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-10-21 12:57:29 UTC