From 2c91d71eb6f7a40cc5391b7f5bbd0cae6070a4b8 Mon Sep 17 00:00:00 2001 From: lr00rl Date: Sat, 24 Oct 2026 03:12:19 -0700 Subject: [PATCH 1/2] ci: pin the security scanners instead of installing latest gosec v2.30.0, released 2026-10-23, turned lattice-server's pull requests red with findings in code v2.29.0 passed. Scanners here now move only when they are bumped on purpose: gosec at v2.29.0 where it runs, and govulncheck at v1.9.0. The vulnerability database is still fetched fresh on every run. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ef146a1..7f1340e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,10 +39,10 @@ jobs: run: go test -race -cover ./... - name: gosec run: | - go install github.com/securego/gosec/v2/cmd/gosec@latest + go install github.com/securego/gosec/v2/cmd/gosec@v2.29.0 gosec ./lattice-node-agent/... - name: govulncheck working-directory: lattice-node-agent run: | - go install golang.org/x/vuln/cmd/govulncheck@latest + go install golang.org/x/vuln/cmd/govulncheck@v1.9.0 govulncheck ./... From ecb7cddaa52222d684acbf439c3a28c2f59bf75f Mon Sep 17 00:00:00 2001 From: lr00rl Date: Sat, 24 Oct 2026 03:28:21 -0700 Subject: [PATCH 2/2] ci: build and release with go 1.26.10 for GO-2026-6809 govulncheck reports GO-2026-6809 on 1.26.9: crypto/x509 gained a denylist of compromised intermediate certificates that Verify now rejects, and the agent reaches Verify through its HTTPS downloads. 1.26.10 carries the fix. The release workflow moves with CI so the next agent release is built with it. --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7f1340e..c05bfa4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: path: lattice-node-agent - uses: actions/setup-go@v6 with: - go-version: '1.26.9' + go-version: '1.26.10' check-latest: true cache: false - name: gofmt diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 500a777..29c95f5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -48,7 +48,7 @@ jobs: path: lattice-node-agent - uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" check-latest: true cache: false - name: build binary