From 021b88e9956f2b13e9cbce322fac4de613ac5232 Mon Sep 17 00:00:00 2001 From: Derek Rein Date: Thu, 20 Aug 2026 13:39:40 +0500 Subject: [PATCH] build(collector): pin build toolchain to go1.26.7 `collector/go.mod` is the toolchain pin for released collector layers: `.github/actions/build-collector-layer/action.yml` runs `actions/setup-go` with `go-version-file: collector/go.mod`, and that action builds the published artifact. The `go` directive has been 1.26.1 across releases 0.22.0 and 0.23.0, so `go version -m` on the released 0.23.0 amd64 collector reports go1.26.1. go1.26.1 is affected by GO-2026-5026 / CVE-2026-39821 (Punycode handling in x/net/idna, vendored into the standard library and reachable through net/http), fixed in go1.26.6. The module's own golang.org/x/net is already v0.57.0, so only the stdlib copy is outstanding. Adds a `toolchain` directive rather than bumping `go`, so the minimum Go version required of importers of this module is unchanged. setup-go is pinned at v7.0.0 everywhere in this repo, and at that revision parseGoVersionFile prefers the `toolchain` directive over `go`. Signed-off-by: Derek Rein --- collector/go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/collector/go.mod b/collector/go.mod index 98bb3089d3..ede89dd4da 100644 --- a/collector/go.mod +++ b/collector/go.mod @@ -2,6 +2,8 @@ module github.com/open-telemetry/opentelemetry-lambda/collector go 1.26.1 +toolchain go1.26.7 + replace github.com/open-telemetry/opentelemetry-lambda/collector/lambdacomponents => ./lambdacomponents replace github.com/open-telemetry/opentelemetry-lambda/collector/lambdalifecycle => ./lambdalifecycle