werkdock/docs/prs/2026-10-20-PR#16-go-toolchain.md

PR#16: A Go Toolchain without Known Vulnerabilities

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

Related Links

• werkdock PR#15: the required checks, with tools/vulncheck.

Problem

go run ./tools/vulncheck fails on main: the code calls vulnerable symbols of the Go standard library. Which ones the code calls depends on the Go that builds werkdock, since go.mod names none.

Non-Goals

• No change of the code.
• No automatic update of the toolchain; a newer Go comes with a PR, e.g. when the nightly build vulnerability-data turns red.

Solution

• go.mod names go1.26.10, the newest Go on 2026-10-20, as its toolchain. The go line stays at 1.22, the oldest language version the code needs, so Go 1.22 or newer can start the build. Such a Go older than go1.26.10 switches to it by GOTOOLCHAIN=auto, the default; so does the Go 1.24.4 of the CI's build image. A newer Go builds with itself; it carries the fixes of go1.26.10, and tools/vulncheck checks the Go that builds. GOTOOLCHAIN=local lets an older Go build, as before; the CI and the release binary do not set it.
• Measured with go run ./tools/vulncheck: go1.26.8 has 7 called vulnerabilities, e.g. GO-2026-6617 in net/http; go1.26.9 and go1.26.10 have none. The CI built with go1.24.4 so far, the binary on mih09 came from go1.22.2.
• Version 0.13.1 with a section in CHANGELOG.md: the binary changes, the CLI does not.
• docs/risk-analysis.md names the toolchain as a measure, and the manual rollout as an open risk: until it is done, mih09 runs the binary of go1.22.2.
• docs/werkdock.werkbaum: the workflow nodes of PR#15 are in use, the toolchain node is merged.

tools/check-licenses now runs go-licenses on the toolchain that builds the module: go env GOVERSION in the module names it, go1.26.10 also where the Go in PATH is older. Built with the Go 1.24.4 of the build image, go-licenses took each package of the go1.26.10 standard library for a package without module information, and the CI build failed.

After the merge, the binary goes to mih09: ~/.werkator/bin/werkdock of mih09-werkator, then a restart of the units werkdock-api-*.service.

Open Questions

None.

Additional Changes

• docs/werkdock.werkbaum: the Dockerfile build of werkdock PR#14 is merged.