Repository navigation
CP-49944: Bump bundled Alloy to v1.21.0, Go to 1.27.2, x/net to v0.61.0 - #1092
Merged
Merged
Conversation
Top of the stack that clears the image scan's new Critical/High findings (GO-2026-6612 and others), with the Go 1.27.2 image bump and the Alloy v1.21.0 bump stacked below it: - go.mod directives and the test Dockerfiles move to Go 1.27.2, which scripts/ci-checks.sh requires to match docker/Dockerfile. - golang.org/x/net moves to v0.61.0 in the root, .tools and tests modules. - prometheus-config-reloader moves from v0.93.1 to v0.94.1. Upstream still resolves x/net v0.58.0, so the reloader stage pins x/net v0.61.0 and the x/crypto v0.58.0 it requires. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X8oDs1PNgjMKCk3RFyazm6
Bumps [cloudzero/alloy](https://github.com/cloudzero/alloy) from v1.20.1 to v1.21.0. - [Changelog](https://github.com/Cloudzero/alloy/blob/main/CHANGELOG.md) - [Commits](https://github.com/cloudzero/alloy/commits) --- updated-dependencies: - dependency-name: cloudzero/alloy dependency-version: v1.21.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps golang from 1.27.1-alpine to 1.27.2-alpine. --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.2-alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dmepham
approved these changes
Oct 21, 2026
 [Medium impact] The PR appears safe to merge; no actionable issue was found in the changes. SummaryUpdates the bundled binaries and Go dependencies to address the reported vulnerability-scan failures.
No actionable issues were found. Builds, tests, and image scans were not run during this review. Reviews (2) · Last reviewed commit: "CP-29639: Bump golang from 1.27.1-alpine..." · Reviewed by Greptile |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
The image vulnerability scan fails on every open PR because of new Critical/High advisories (GO-2026-6612 and others) in the Go standard library and
golang.org/x/net. The findings come from three sources, and the scan stays red until all three are fixed. No single Dependabot PR fixes them all, so this PR stacks them:golangimage1.27.1-alpine→1.27.2-alpinev1.20.1→v1.21.0. v1.20.1 bundles a go1.26.7 binary; v1.21.0 is built with Go 1.27.2 and x/net v0.61.0.developWhat
On top of the two Dependabot bumps:
go.modfiles and the two test Dockerfiles move to1.27.2.scripts/ci-checks.shrequires them to matchdocker/Dockerfile.v0.61.0in the root,.toolsandtestsmodules.go getalso pulled in the relatedgolang.org/x/*minor bumps.v0.93.1→v0.94.1. Upstream still resolves x/net v0.58.0, so the reloader stage now pinsx/net v0.61.0, plusx/crypto v0.58.0, which that x/net requires.How Tested
make format generate lint test buildandscripts/ci-checks.shpass locally.🤖 Generated with Claude Code
https://claude.ai/code/session_01X8oDs1PNgjMKCk3RFyazm6