[sjmiller609]

Summary

• Require Go 1.26.10 for server builds and align CI, Linux/macOS releases, builder agents and development/source-install bootstrap pins.
• This release includes the CVE-2026-111943 certificate-chain mitigation. Embedded Caddy, guest-agent and init binaries are rebuilt by the existing release preparation.

Validation

• Passed go build -tags containers_image_openpgp ./....
• Passed targeted short tests for lib/ingress/..., lib/system/... and deploy/aws/cloudformation.
• Rebuilt Caddy for amd64/arm64 and the embedded Linux guest-agent/init; verified Caddy uses Go 1.26.10.
• Full hypervisor integration tests, macOS builds, full builder-image builds and cfn-lint were not run.

Rollout

Release/rebuild and deploy after merging, with the infrastructure toolchain/trust updates. No running hosts or services were changed.

---

Note

Low Risk
Version-pin-only change across CI, Docker, and bootstrap scripts; no runtime behavior changes until artifacts are rebuilt and redeployed.

Overview
Bumps the required Go toolchain from 1.25.4 to 1.26.10 everywhere Hypeman is built or bootstrapped, so local, CI, release, and infra installs stay on one compiler version (including the CVE-2026-111943 certificate-chain fix in this Go release).

go.mod now declares go 1.26.10. GitHub Actions in deploy.yml, release.yml, and test.yml (Linux KVM, macOS test, and e2e jobs) all use that version via actions/setup-go. deploy/aws/cloudformation/template.yaml downloads go1.26.10.linux-amd64 when building from a branch on EC2. The generic builder image lib/builds/images/generic/Dockerfile switches the agent build stage from golang:1.25-alpine to golang:1.26.10-alpine. scripts/utm/bootstrap-dev-environment.sh pins the same version for arm64 dev VMs.

There are no application or API logic changes in the diff—only version pins. Embedded binaries (Caddy, guest-agent, etc.) are expected to be rebuilt on the normal release path after merge.

^{Reviewed by Cursor Bugbot for commit 2c5391e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chruffins]

Bugs

• scripts/utm/bootstrap-dev-environment.sh:52 — the guard grep -q "go1.2" matches go1.25.4, so machines that already have a 1.2x toolchain skip the install and never reach the new GO_VERSION on line 55. compare the installed version against GO_VERSION before skipping. the guard predates this PR, but the bump is what it needs to deliver.

Questions

• .github/actions/setup-stlc/action.yml:20 — go-version: "stable" floats and is not pinned. is SDK generation meant to be in the 1.26.10 alignment scope? this line is not in the diff.

Structural / Maintainability

• .github/workflows/test.yml:92 — the same version is hand-written in ten places: six workflow pins, go.mod, the builder Dockerfile, the CloudFormation download, and the bootstrap script. this duplication predates the PR. vuln-remediation.yml:16 already uses go-version-file: 'go.mod', so the workflows could follow it. suggested as a follow-up, not a blocker.

Nits

• DEVELOPMENT.md:9, :19, :371 — still say "Go 1.25.4+". update them to 1.26.10+.

coverage — all 7 changed files inspected. repo-wide grep found no other executable 1.25 pins; remaining hits are test fixtures (golang:1.21, golang:1.22 examples) and unrelated text. go1.26.10 is present in the go.dev release index, and the Dockerfile and tarball names are correct. not verified: the CVE-2026-111943 mitigation claim, rebuilt Caddy/guest-agent/init binaries, macOS builds, full builder-image builds, cfn-lint.
status: review complete; read-only analysis; no tests run