From c28d42059f2e60283d3a36d5eda6d92ff95ea777 Mon Sep 17 00:00:00 2001 From: Andre Eleuterio Date: Wed, 21 Oct 2026 11:19:58 -0300 Subject: [PATCH 1/2] security: patch CVE-2026-111943 (eMudhra CA compromise) Bump Go to 1.26.10 and upgrade Alpine ca-certificates-bundle to 20261020-r0. --- Dockerfile | 7 ++++--- Dockerfile.release | 5 +++-- go.mod | 2 +- mise.toml | 2 +- 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6a1d6bf01d..6a865963eb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,17 +4,18 @@ # # Nothing fancy here: we copy in the source code and build on the Alpine Go # image. Refer to .dockerignore to get a sense of what we're not going to copy. -FROM golang:1.26.5-alpine3.23@sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc AS builder +FROM golang:1.26.10-alpine3.23@sha256:a07f231c19b03e6106cf442f02a5bcf262147e744d15b7b5e4b6d81d420c70a0 AS builder COPY . /src WORKDIR /src RUN go build ./cmd/src # This stage should be kept in sync with Dockerfile.release. -FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 +FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8 # needed for `src code-intel upload` and `src actions exec` -RUN apk add --no-cache git +# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943). +RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle COPY --from=builder /src/src /usr/bin/ ENTRYPOINT ["/usr/bin/src"] diff --git a/Dockerfile.release b/Dockerfile.release index db46c56835..baccfc98f5 100644 --- a/Dockerfile.release +++ b/Dockerfile.release @@ -2,10 +2,11 @@ # suitable for testing, since it depends on a src binary being at the project # root _and_ that src binary being runnable on Alpine. To test this, refer to # the main Dockerfile, which should have an identical second stage. -FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1 +FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8 # needed for `src code-intel upload` and `src actions exec` -RUN apk add --no-cache git +# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943). +RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle COPY src /usr/bin/ ENTRYPOINT ["/usr/bin/src"] diff --git a/go.mod b/go.mod index 3a97776d6e..7e006f9e7b 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/sourcegraph/src-cli -go 1.26.5 +go 1.26.10 require ( cloud.google.com/go/storage v1.50.0 diff --git a/mise.toml b/mise.toml index 240c82d6fc..e8cfe85732 100644 --- a/mise.toml +++ b/mise.toml @@ -1,4 +1,4 @@ [tools] -golang = "1.26.5" +golang = "1.26.10" shfmt = "3.8.0" shellcheck = "0.10.0" From 7deae1d5bbba95d3d5aded4a8b9dc8693343517e Mon Sep 17 00:00:00 2001 From: Andre Eleuterio Date: Wed, 21 Oct 2026 11:40:56 -0300 Subject: [PATCH 2/2] security: patch volume-workspace image, lib go.mod, changelog for CVE-2026-111943 --- CHANGELOG.md | 1 + dev/vendor-lib.sh | 2 +- docker/batch-change-volume-workspace/Dockerfile | 5 +++-- lib/go.mod | 2 +- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7cd8ccb416..8b1d75c623 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ All notable changes to `src-cli` are documented in this file. ### Changed +- Updated Go to 1.26.10 and the Alpine `ca-certificates-bundle` in Docker images to 20261020-r0 to stop trusting the compromised eMudhra CAs ([CVE-2026-111943](https://emudhra.we-have-a-problem.com/)). - HTTP requests now fail instead of hanging forever if the server does not start responding within 1 minute. Set the `SRC_RESPONSE_HEADER_TIMEOUT` environment variable to change this timeout, or to `0` to disable it. Responses that stream data for a long time (for example, large search job results) are not affected. - `src search-jobs logs` and `src search-jobs results` now use the standard API client, gaining proxy support, `-insecure-skip-verify`, and cross-host redirect protection, and now report an error on non-200 responses instead of writing the error page into the output. - The command list in `src help` is now generated from the registered commands instead of being maintained by hand. `src debug`, `src snapshot`, and `src lsp` now appear in it; aliases are shown after each description. diff --git a/dev/vendor-lib.sh b/dev/vendor-lib.sh index 06db251bd9..d007d89352 100755 --- a/dev/vendor-lib.sh +++ b/dev/vendor-lib.sh @@ -136,7 +136,7 @@ echo "Creating go.mod file..." cat > "$DEST_LIB/go.mod" <= 20261020-r0 drops the eMudhra roots (CVE-2026-111943). +RUN apk add --update git unzip && apk upgrade --no-cache ca-certificates-bundle diff --git a/lib/go.mod b/lib/go.mod index a55ba1bc9f..0ebb8b20bf 100644 --- a/lib/go.mod +++ b/lib/go.mod @@ -1,6 +1,6 @@ module github.com/sourcegraph/sourcegraph/lib -go 1.26.5 +go 1.26.10 require ( github.com/Masterminds/semver v1.5.0