Repository navigation
chore: update Go to 1.26.10, Node to 26.12.1 and the CA bundle - #458
Conversation
- go.mod: go 1.25.0 to 1.26.10. CI and release builds take their Go version from go.mod, so release binaries build on 1.26.10. - Dockerfile: golang 1.27.1-alpine to 1.27.3-alpine, and the frontend build stage to node 26.12.1. - Dockerfile, Dockerfile.goreleaser: upgrade ca-certificates-bundle along with ca-certificates in the alpine 3.24.1 runtime stage, so the image does not keep the base image's older bundle package. - Isolation image: node 26-bookworm-slim to 26.12.1. The asset hash that tags the image changes with it, so existing installs rebuild it on first use; TestAssetsHash_Stable is updated to the new hash.
|
💬 Discussion in Slack: #pr-review-agent-vault-458-chore-update-go-to-1-26-10-node-to-26-12-1-and-the-ca Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| module github.com/Infisical/agent-vault | ||
|
|
||
| go 1.25.0 | ||
| go 1.26.10 |
There was a problem hiding this comment.
🔴 After merge, the Daytona example fails at its Go build step, because it compiles main with golang:1.25-alpine. That image cannot satisfy the new go 1.26.10 directive. Official golang images set GOTOOLCHAIN=local, so a 1.25 toolchain refuses a module that requires go >= 1.26.10 instead of downloading a newer one. Fix: update every pinned or documented Go 1.25 reference along with the directive. Use golang:1.27-alpine (or 1.26) in the example, and say Go 1.26.10+ in the docs. Same pattern at 4 sites (examples/daytona-openai-realtime/run.mjs:27, docs/self-hosting/local.mdx:28, docs/installation.mdx:41, docs/self-hosting/docker.mdx:17). [also at: examples/daytona-openai-realtime/run.mjs:28 - After merge, the Daytona example can no longer build agent-vault from main. Its build container runs Go 1.25, but go.mod now requires 1.26.10. go.mod:3 moves the go directive from 1.25.0 to 1.26.10. run.mjs:27 still builds inside golang:1.25-alpine, and the official golang images set GOTOOLCHAIN=local, so go build exits with "go.mod requires go >= 1.26.10".]
Why this was flagged
examples/daytona-openai-realtime/run.mjs:244 sets AGENT_VAULT_REF to "main" by default, and line 23 clones that ref. Line 27 then runs go build inside golang:1.25-alpine. After this merge, go.mod:3 on main reads go 1.26.10. The official golang images ship ENV GOTOOLCHAIN=local, so Go 1.25 exits with "go.mod requires go >= 1.26.10 (running go 1.25.x; GOTOOLCHAIN=local)". The script runs under set -eu, so it aborts before the agent-vault container ever starts. On the base branch the directive is go 1.25.0, which golang:1.25-alpine builds fine. CI cannot catch this: ci.yml reads the Go version from go.mod via go-version-file and never runs the example. The docs (local.mdx:28, installation.mdx:41) still list Go 1.25+ as the prerequisite. docker.mdx:17 still describes the builder as golang:1.25-alpine.
Verification: go.mod:3 changes from go 1.25.0 to go 1.26.10. examples/daytona-openai-realtime/run.mjs:244 sets the default AGENT_VAULT_REF: process.env.AGENT_VAULT_REF ?? "main". The official golang images have set ENV GOTOOLCHAIN=local since Go 1.21. On the base branch, go 1.25.0 builds fine with golang:1.25-alpine, so this is a regression this change introduces.
 [Medium impact] The changes appear safe to merge; no new actionable issues were found.
|
go.mod now needs Go 1.26.10 or later, and the official golang images set GOTOOLCHAIN=local, so the Daytona example's golang:1.25-alpine build step stopped with "go.mod requires go >= 1.26.10". Build it on golang:1.26-alpine. The build-from-source prerequisites said Go 1.25+, the Docker guide listed the node:22-alpine, golang:1.25-alpine and alpine:3.21 stages, and the isolation guide and integration test still named Node 22 for the isolation image. Update them to what the build uses.
The node:26-bookworm-slim digest pinned in the previous commit was replaced the same day by a rebuilt index for the same 26.12.1 release, which 26-bookworm-slim and 26.12.1-bookworm-slim both point to now. Dependabot would re-pin it, change the asset hash again, and make every container-mode user rebuild the isolation image a second time. Pin the current digest now and update TestAssetsHash_Stable to match.
The deploy-agent-container guide's Dockerfile started from node:20-slim. Node 20 is past end of life and gets no further releases, including the root store update in Node 22.23.4, 24.22.1 and 26.12.1, so an agent container built from the guide trusted certificates that newer Node releases do not. Use node:22-slim, which has that update.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Summary
Type of change
Test plan
make test)Security checklist