Skip to content

fix(tunnel): bump tailscale to v1.104.2 (Go 1.27.3) - #776

Closed
ValgulNecron wants to merge 1 commit into
masterfrom
claude/project-thread-unjssc-tailscale
Closed

fix(tunnel): bump tailscale to v1.104.2 (Go 1.27.3)#776
ValgulNecron wants to merge 1 commit into
masterfrom
claude/project-thread-unjssc-tailscale

Conversation

@ValgulNecron

@ValgulNecron ValgulNecron commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Bumps the tailscale-stage base in tunnel/Dockerfile.tailscale from v1.104.1@sha256:87c55d6b… to v1.104.2@sha256:b11583ad… (multi-arch index digest).

Why

publish-edge (run 39513312657) fails Trivy on tunnel-tailscale with 4 HIGH findings in tailscaled: stdlib CVE-2026-78667, CVE-2026-97031, CVE-2026-78669 (Go 1.27.1, fixed in 1.27.2), plus CVE-2026-78669 on golang.org/x/net v0.59.0.

go version -m on tailscaled from tailscale/tailscale:v1.104.2 (linux/amd64) shows go1.27.3, which fixes the three stdlib findings and also CVE-2026-111943 (Go's crypto/x509 block of the compromised eMudhra intermediates). govulncheck -mode binary reports 0 reachable vulnerabilities.

Known gap

v1.104.2 still ships golang.org/x/net v0.59.0, so Trivy will keep flagging CVE-2026-78669 on x/net (fixed in 0.60.0) and publish-edge stays red on tunnel-tailscale after this merges. unstable-v1.105.79 already has x/net v0.60.0, so the next stable tailscale release should clear it.

🤖 Generated with Claude Code

@claude
fix(tunnel): bump tailscale to v1.104.2
aac4158 
v1.104.2 builds tailscaled with Go 1.27.3, which fixes the stdlib
CVE-2026-78667, CVE-2026-97031 and CVE-2026-78669 (Go 1.27.2) and the
eMudhra intermediate distrust CVE-2026-111943 (Go 1.27.3). golang.org/x/net
is still v0.59.0 upstream, so CVE-2026-78669 stays flagged on x/net.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
@ValgulNecron ValgulNecron added type: security Security hardening or vulnerability fix area: optional-components sentinel, capture-sidecar, mcp-server, tunnel, audit-syslog-bridge, telemetry-receiver labels Oct 21, 2026 — with Claude
@ValgulNecron ValgulNecron self-assigned this Oct 21, 2026
@coderabbitai

coderabbitai Bot commented Oct 21, 2026

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: GameplanePanel/Gameplane/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d76affb4-7447-4813-8bd2-3f2a557e6690
📥 Commits

Reviewing files that changed from the base of the PR and between df1e371 and aac4158.

📒 Files selected for processing: 1
  • tunnel/Dockerfile.tailscale
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ValgulNecron ValgulNecron mentioned this pull request Oct 21, 2026
Merged
@ValgulNecron Claude

ValgulNecron commented Oct 21, 2026

Copy link
Copy Markdown
Collaborator Author

Closing. The same tailscale v1.104.2 bump is now a commit in #775, which carries all the fixes from this security check in one PR.

Generated by Claude Code

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

CI Report - aac4158

run 39642766658 - attempt 1

1 failed - 21 passed - 11 skipped - 244m18s elapsed

Failing

Job Log
e2e-go-arm64 logs

Coverage

no coverage/* commit statuses found on aac4158

Changed

Area Files +/-
tunnel/ 1 +1/-1

Slowest jobs

Job Duration
e2e telemetry / arm64 (kind) 22m12s
e2e telemetry / amd64 (kind) 21m16s
build e2e images 10m24s
build e2e images (arm64) 10m14s
e2e multicluster / amd64 (kind x2) 9m56s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, multicluster, operator, optional-components, ratelimit, telemetry, upgrade

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@ValgulNecron ValgulNecron

Labels

area: optional-components sentinel, capture-sidecar, mcp-server, tunnel, audit-syslog-bridge, telemetry-receiver type: security Security hardening or vulnerability fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ValgulNecron @claude