Skip to content

Move to Go 1.26.8 and clear reachable dependency vulnerabilities #394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dpage merged 4 commits into from
Sep 14, 2026
Merged

Move to Go 1.26.8 and clear reachable dependency vulnerabilities #394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
96921fa
Move to Go 1.26.5 and clear reachable dependency vulnerabilities
dpage Aug 7, 2026
a5723b7
Move to Go 1.26.8 to clear the newer stdlib advisories
dpage Sep 10, 2026
e85e74e
Run the service CI workflows for changes under pkg/
dpage Sep 14, 2026
dc91a81
Correct the changelog and clear the remaining npm audit findings
dpage Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions .github/workflows/ci-alerter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,13 @@ on:
branches: [ main, master ]
paths:
- 'alerter/**'
- 'pkg/**'
- '.github/workflows/ci-alerter.yml'
pull_request:
branches: [ main, master ]
paths:
- 'alerter/**'
- 'pkg/**'
- '.github/workflows/ci-alerter.yml'

jobs:
Expand All @@ -18,7 +20,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
go-version: ['1.26.2']
go-version: ['1.26.8']
postgres-version: ['14', '15', '16', '17', '18']
fail-fast: false

Expand Down Expand Up @@ -65,20 +67,20 @@ jobs:
run: go mod download

- name: Lint alerter code
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: alerter
run: |
go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
make lint

- name: Run go vet
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: alerter/src
run: go vet ./...

- name: Check formatting
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: alerter
run: |
gofmt -l ./src > /tmp/gofmt.out
Expand Down Expand Up @@ -111,7 +113,7 @@ jobs:
run: make coverage

- name: Generate coverage report
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: alerter/src
run: |
go tool cover -func=coverage.out
Expand All @@ -126,7 +128,7 @@ jobs:
# we set working-directory there and use relative paths for
# -infile/-outfile.
- name: Convert coverage to lcov
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: alerter/src
run: |
go install github.com/jandelgado/gcov2lcov@v1.1.1
Expand All @@ -136,7 +138,7 @@ jobs:
# Finalization (the single `final` call) happens in the client
# CI workflow after all language partials have been pushed.
- name: Upload coverage to Codacy
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
env:
CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
run: |
Expand All @@ -147,15 +149,15 @@ jobs:
-r alerter/src/coverage.lcov

- name: Upload build artifact
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: ai-dba-alerter-linux-amd64
path: alerter/ai-dba-alerter
retention-days: 7

- name: Upload coverage artifact
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: alerter-coverage
Expand Down
20 changes: 11 additions & 9 deletions .github/workflows/ci-collector.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,13 @@ on:
branches: [ main, master ]
paths:
- 'collector/**'
- 'pkg/**'
- '.github/workflows/ci-collector.yml'
pull_request:
branches: [ main, master ]
paths:
- 'collector/**'
- 'pkg/**'
- '.github/workflows/ci-collector.yml'

jobs:
Expand All @@ -18,7 +20,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
go-version: ['1.26.2']
go-version: ['1.26.8']
postgres-version: ['14', '15', '16', '17', '18']
fail-fast: false

Expand Down Expand Up @@ -65,20 +67,20 @@ jobs:
run: go mod download

- name: Lint collector code
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: collector
run: |
go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
make lint

- name: Run go vet
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: collector
run: go vet ./...

- name: Check formatting
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: collector
run: |
gofmt -l ./src > /tmp/gofmt.out
Expand Down Expand Up @@ -111,7 +113,7 @@ jobs:
run: make coverage

- name: Generate coverage report
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: collector
run: |
go tool cover -func=src/coverage.out
Expand All @@ -127,7 +129,7 @@ jobs:
# working-directory to collector and use src/-prefixed paths
# for -infile/-outfile.
- name: Convert coverage to lcov
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: collector
run: |
go install github.com/jandelgado/gcov2lcov@v1.1.1
Expand All @@ -137,7 +139,7 @@ jobs:
# Finalization (the single `final` call) happens in the client
# CI workflow after all language partials have been pushed.
- name: Upload coverage to Codacy
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
env:
CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
run: |
Expand All @@ -148,15 +150,15 @@ jobs:
-r collector/src/coverage.lcov

- name: Upload build artifact
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: ai-dba-collector-linux-amd64
path: collector/ai-dba-collector
retention-days: 7

- name: Upload coverage artifact
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: collector-coverage
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: '1.26.2'
go-version: '1.26.8'

- name: Set up Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
Expand Down
20 changes: 11 additions & 9 deletions .github/workflows/ci-server.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,13 @@ on:
branches: [ main, master ]
paths:
- 'server/**'
- 'pkg/**'
- '.github/workflows/ci-server.yml'
pull_request:
branches: [ main, master ]
paths:
- 'server/**'
- 'pkg/**'
- '.github/workflows/ci-server.yml'

jobs:
Expand All @@ -18,7 +20,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
go-version: ['1.26.2']
go-version: ['1.26.8']
postgres-version: ['14', '15', '16', '17', '18']
fail-fast: false

Expand Down Expand Up @@ -65,20 +67,20 @@ jobs:
run: go mod download

- name: Lint server code
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: server
run: |
go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
make lint

- name: Run go vet
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: server/src
run: go vet ./...

- name: Check formatting
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: server
run: |
gofmt -l ./src > /tmp/gofmt.out
Expand Down Expand Up @@ -111,7 +113,7 @@ jobs:
run: make coverage

- name: Generate coverage report
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: server/src
run: |
go tool cover -func=coverage.out
Expand All @@ -126,7 +128,7 @@ jobs:
# we set working-directory there and use relative paths for
# -infile/-outfile.
- name: Convert coverage to lcov
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
working-directory: server/src
run: |
go install github.com/jandelgado/gcov2lcov@v1.1.1
Expand All @@ -136,7 +138,7 @@ jobs:
# Finalization (the single `final` call) happens in the client
# CI workflow after all language partials have been pushed.
- name: Upload coverage to Codacy
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
env:
CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
run: |
Expand All @@ -147,15 +149,15 @@ jobs:
-r server/src/coverage.lcov

- name: Upload build artifact
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: ai-dba-server-linux-amd64
path: server/ai-dba-server
retention-days: 7

- name: Upload coverage artifact
if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
if: matrix.go-version == '1.26.8' && matrix.postgres-version == '18'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: server-coverage
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,7 +250,7 @@ jobs:
- name: Set up Go 1.26
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: '1.26.2'
go-version: '1.26.8'
cache: false

- name: Cache Go modules (server)
Expand Down
2 changes: 1 addition & 1 deletion alerter/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
#--------------------------------------------------------------------------

# Stage 1: Build the alerter binary
FROM golang:1.26.2 AS builder
FROM golang:1.26.8 AS builder

WORKDIR /build

Expand Down
8 changes: 3 additions & 5 deletions alerter/src/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
module github.com/pgedge/ai-workbench/alerter

go 1.26.1

toolchain go1.26.2
go 1.26.8

require (
github.com/jackc/pgx/v5 v5.9.2
Expand All @@ -21,6 +19,6 @@ require (
github.com/kr/text v0.2.0 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
golang.org/x/crypto v0.47.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/text v0.33.0 // indirect
golang.org/x/sync v0.22.0 // indirect
golang.org/x/text v0.40.0 // indirect
)
8 changes: 4 additions & 4 deletions alerter/src/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,10 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
Expand Down
Loading
Loading