# PR#16: A Go Toolchain without Known Vulnerabilities

> **WARNING:** This document describes only the change applied in this PR.
> It may already be outdated once the next PR is merged.
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

## Related Links

- [werkdock PR#15](https://git.javagil.de/mi/werkdock/pulls/15): the required checks, with `tools/vulncheck`.

## Problem

`go run ./tools/vulncheck` fails on `main`: the code calls vulnerable symbols of the Go standard library.
Which ones the code calls depends on the Go that builds werkdock, since `go.mod` names none.

## Non-Goals

- No change of the code.
- No automatic update of the toolchain; a newer Go comes with a PR, e.g. when the nightly build `vulnerability-data` turns red.

## Solution

- `go.mod` names go1.26.10, the newest Go on 2026-10-20, as its toolchain.
  The `go` line stays at 1.22, the oldest language version the code needs, so Go 1.22 or newer can start the build.
  Such a Go older than go1.26.10 switches to it by `GOTOOLCHAIN=auto`, the default;
  so does the Go 1.24.4 of the CI's build image.
  A newer Go builds with itself; it carries the fixes of go1.26.10, and `tools/vulncheck` checks the Go that builds.
  `GOTOOLCHAIN=local` lets an older Go build, as before; the CI and the release binary do not set it.
- Measured with `go run ./tools/vulncheck`:
  go1.26.8 has 7 called vulnerabilities, e.g. GO-2026-6617 in `net/http`; go1.26.9 and go1.26.10 have none.
  The CI built with go1.24.4 so far, the binary on mih09 came from go1.22.2.
- Version 0.13.1 with a section in `CHANGELOG.md`: the binary changes, the CLI does not.
- `docs/risk-analysis.md` names the toolchain as a measure, and the manual rollout as an open risk:
  until it is done, mih09 runs the binary of go1.22.2.
- `docs/werkdock.werkbaum`: the workflow nodes of PR#15 are in use, the toolchain node is merged.

`tools/check-licenses` now runs go-licenses on the toolchain that builds the module:
`go env GOVERSION` in the module names it, go1.26.10 also where the Go in `PATH` is older.
Built with the Go 1.24.4 of the build image, go-licenses took each package of the go1.26.10 standard library
for a package without module information, and the CI build failed.

After the merge, the binary goes to mih09:
`~/.werkator/bin/werkdock` of `mih09-werkator`, then a restart of the units `werkdock-api-*.service`.

## Open Questions

None.

## Additional Changes

- `docs/werkdock.werkbaum`: the Dockerfile build of werkdock PR#14 is merged.