From de731e4f5e8efd1e2fa2e4d0e55e1d558a6fb34d Mon Sep 17 00:00:00 2001 From: Josh Date: Wed, 14 Oct 2026 09:56:12 +0200 Subject: [PATCH 1/2] [BEE-1343] Security fix service binary in localstack docker desktop Moves the builder from golang:1.25-alpine to golang:1.26-alpine. Go 1.25 is EOL and the floating tag is stuck at 1.25.14; the three flagged stdlib CVEs are only fixed in 1.26.9 / 1.27.2, so a rebuild alone no longer clears them. The tag stays floating on the 1.26 line so future stdlib CVEs keep self-healing on routine rebuilds. CVE-2026-78667 net/http CVE-2026-78669 net/http/internal/http2 CVE-2026-97031 crypto/tls Bumps golang.org/x/net to v0.60.0, clearing CVE-2026-78669 in the module copy of http2. x/net@v0.60.0 requires go 1.26, which raises the go directive; x/crypto, x/sys and x/text move with it as MVS requirements. Bumps TAG to 2026.10.0. Verified with trivy: service gobinary goes from 5 HIGH to 1 HIGH. The remainder is CVE-2026-55677 against echo v3.3.10+incompatible, which has no fixed version for the v3 module path. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 6 ++++++ Dockerfile | 2 +- Makefile | 2 +- vm/go.mod | 10 +++++----- vm/go.sum | 16 ++++++++-------- 5 files changed, 21 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a1741bc..de35bf8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project uses calendar versioning (`..`). +## [2026.10.0] — 2026-10-14 + +### Changed + +- Security update — clears CVE-2026-78667, CVE-2026-78669, CVE-2026-97031 + ## [2026.9.0] — 2026-09-01 ### Changed diff --git a/Dockerfile b/Dockerfile index ab64699..88ca1a6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.25-alpine AS builder +FROM golang:1.26-alpine AS builder ENV CGO_ENABLED=0 WORKDIR /backend COPY vm/go.* ./ diff --git a/Makefile b/Makefile index 195a1f6..655b18e 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ IMAGE?=localstack/localstack-docker-desktop -TAG?=2026.9.0 +TAG?=2026.10.0 BUILDER=buildx-multi-arch diff --git a/vm/go.mod b/vm/go.mod index ba6c228..7aecbcb 100644 --- a/vm/go.mod +++ b/vm/go.mod @@ -1,6 +1,6 @@ module LocalStack -go 1.25.0 +go 1.26.0 require ( github.com/labstack/echo v3.3.10+incompatible @@ -13,8 +13,8 @@ require ( github.com/mattn/go-isatty v0.0.20 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect github.com/valyala/fasttemplate v1.2.2 // indirect - golang.org/x/crypto v0.55.0 // indirect - golang.org/x/net v0.58.0 // indirect - golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/crypto v0.57.0 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/text v0.42.0 // indirect ) diff --git a/vm/go.sum b/vm/go.sum index 20b7d3d..f6f941f 100644 --- a/vm/go.sum +++ b/vm/go.sum @@ -21,16 +21,16 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo= github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ= -golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= -golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= From feaadef7bf2dbda81ea5a22933be0e8aa8cbcd34 Mon Sep 17 00:00:00 2001 From: Josh Date: Wed, 14 Oct 2026 10:54:18 +0200 Subject: [PATCH 2/2] Leave version bump and changelog to the release workflow security-rebuild.yml reads TAG from the Makefile as the currently published version and scans that image, then bump-version.sh writes the new TAG and CHANGELOG entry itself. A manual bump to 2026.10.0 would make it scan a tag that was never published. Reverts the Makefile and CHANGELOG changes from the previous commit; the workflow will produce the same 2026.10.0 entry on release. Also updates the README's builder reference to golang:1.26-alpine. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 6 ------ Makefile | 2 +- README.md | 2 +- 3 files changed, 2 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index de35bf8..a1741bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,12 +2,6 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project uses calendar versioning (`..`). -## [2026.10.0] — 2026-10-14 - -### Changed - -- Security update — clears CVE-2026-78667, CVE-2026-78669, CVE-2026-97031 - ## [2026.9.0] — 2026-09-01 ### Changed diff --git a/Makefile b/Makefile index 655b18e..195a1f6 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ IMAGE?=localstack/localstack-docker-desktop -TAG?=2026.10.0 +TAG?=2026.9.0 BUILDER=buildx-multi-arch diff --git a/README.md b/README.md index 984d15a..e0dd11f 100644 --- a/README.md +++ b/README.md @@ -60,7 +60,7 @@ To contribute, check out our [issue tracker](https://github.com/localstack/local Most CVEs reported against this image come from the Go toolchain compiled into the `service` binary rather than from any dependency manifest, so they are fixed -by rebuilding on a newer `golang:1.25-alpine` rather than by bumping anything. +by rebuilding on a newer `golang:1.26-alpine` rather than by bumping anything. The [weekly security rebuild](.github/workflows/security-rebuild.yml) does this automatically: it scans the published image, rebuilds from scratch, and