[TechnoFinch]

Advisory: https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html

Version change

Go toolchain: 1.22.12 (devcontainer) / 1.23.8 (dependencies.sh, used by CI, release workflows and docker/*.Dockerfile) / go.mod toolchain go1.23.7, go1.23.8, go1.24.1 -> go1.26.10.

Go 1.26.10 adds the crypto/x509 blocklist of the eMudhra/emSign intermediates. The fix only takes effect once the binaries are rebuilt with this toolchain and redeployed.

Files changed

• .devcontainer/Dockerfile: Go tarball go1.22.12 -> go1.26.10.
• dependencies.sh: GOVER=1.23.8 -> 1.26.10. CI (ci.yml, ci_cu13.yml), the release workflows and docker/mooncake.Dockerfile / docker/musa.Dockerfile all install Go through this script.
• mooncake-common/etcd/go.mod: toolchain -> go1.26.10. Fixes critical/high vulns: etcd client v3.5.21 -> v3.5.33, grpc v1.59.0 -> v1.83.2 (indirect). go-mod-tidy also moved x/net, x/sys, x/text, protobuf and genproto as required by the new versions.
• mooncake-p2p-store/src/p2pstore/go.mod: toolchain -> go1.26.10. Same etcd (v3.5.15 -> v3.5.33) and grpc (-> v1.83.2) bumps.
• mooncake-transfer-engine/example/http-metadata-server/go.mod: toolchain -> go1.26.10. golang.org/x/crypto v0.36.0 -> v0.52.0 (critical/high fixes). x/net, x/sys and x/text moved up with it.

go line change: the go directive went from 1.23.0 to 1.25.0 in all three modules. We did not choose this: the fixed grpc, etcd and x/crypto releases need go >= 1.25. This changes GODEBUG defaults for these modules to the 1.25 ones (for example x509 and TLS defaults introduced in 1.24 and 1.25). Every build path installs go1.26.10, so that is fine.

Local build/test

All builds ran with GOTOOLCHAIN=go1.26.10:

• go build ./... passes in all 3 modules. go build -buildmode=c-shared etcd_wrapper.go (as build.sh does it) also passes.
• go vet shows the same warnings as before the change (lostcancel in etcd_wrapper.go, unsafe.Pointer in p2pstore). Nothing new.
• No _test.go files in these modules.
• vulngate --all: exit 0 for all 3 modules (no fixable critical/high left). Medium/low findings remain, and they don't block.
• The C++/CMake build was not run locally (it needs Linux/RDMA deps). CI covers it.

Impact assessment

Downtime risk: medium.

• The Go jump is large (1.22/1.23 -> 1.26). The go line also moved to 1.25 because of dependencies, so the GODEBUG defaults for 1.24 and 1.25 apply. Examples: stricter x509 parsing, and TLS defaults such as post-quantum X25519MLKEM768 key exchange and removal of 3DES/RSA key exchange. The Go code is small: an etcd client wrapper (c-shared lib), the p2p store etcd client, and an example gin HTTP metadata server. They talk to etcd and peers, mostly in plaintext or on internal networks.
• grpc moves from 1.59 to 1.83 and etcd client from 3.5.15/3.5.21 to 3.5.33. Both stay within the same major versions and the API is compatible (builds pass). Still, smoke-test against your etcd cluster.
• Go 1.26 needs Linux kernel 3.2+ and glibc compatible with cgo. This is the same requirement as before.

Cert exposure: none found. No emSign/eMudhra references, custom CA bundles, x509.CertPool/RootCAs, or SSL_CERT_FILE usage. Outbound connections go to etcd and internal peers.

Deploy/rollout: CI, the release workflows and the docker images get Go from dependencies.sh, so they pick up 1.26.10 automatically. The Python wheels and images that bundle libetcd_wrapper.so and the p2p store must be rebuilt and redeployed. The base image and libc are unchanged. CGO is used as before (c-shared). A rolling deploy should be safe because nothing changes on the wire.

ca-certificates workaround: none of the upstream vendor images have been rebuilt with the fixed ca-certificates yet (nvidia/cuda 12.8.1 and mthreads/musa rc4.3.0, both Ubuntu 22.04). So docker/mooncake.Dockerfile and docker/musa.Dockerfile now run an upgrade of ca-certificates from jammy-security right after each FROM, and the build fails if the installed version is older than 20260816. The build-musa CI container job does the same upgrade and check.

monitoring/: grafana/grafana 13.2.4 (newest release, Alpine 3.24) still ships the old ca-certificates. A small wrapper monitoring/grafana/Dockerfile runs apk upgrade ca-certificates as root, fails if the version is below 20261020-r0, then switches back to user 472. docker-compose.yml builds it, and run.sh builds it before docker run, so both use the local mooncake-grafana:13.2.4 image.

[broly-code-security-scanner]

Broly Security Scan

Caution

⚠️ Container scan did not complete for monitoring/docker-compose.yml image prom/prometheus:v3.15.1.

Note

Summary

5 actionable finding(s) in this PR
6 total in scan · 1 dismissed false positive

• 🟠 1 high
• 🟡 4 medium

Main table: 3 shown, 2 omitted of 5 actionable finding(s) above the reporting threshold. See the repository Security tab for the full set.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟠 HIGH	CONTAINER	ALPINE-CVE-2026-85091: zlib@1.3.2-r0	monitoring/grafana/Dockerfile:1	d12	Needs review
🟡 MEDIUM	SCA	golang.org/x/net@0.58.0 — 5 vulnerabilities (worst: GO-2026-6603) → fixed in 0.60.0	mooncake-p2p-store/src/p2pstore/go.mod, mooncake-common/etcd/go.mod:1	d9	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	DOCKERFILE	Downloaded Go tarball is not integrity-verified (no checksum comparison before extraction).	.devcontainer/Dockerfile:29	d7	🔺 TRUE_POSITIVE · Confidence: HIGH

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d12 · 🟠 HIGH     · monitoring/grafana/Dockerfile:1 · ALPINE-CVE-2026-85091: zlib@1.3.2-r0
• d10 · 🟡 MEDIUM   · .github/workflows/ci.yml:1 · overly broad permissions
• d11 · 🟡 MEDIUM   · .github/workflows/ci.yml:195 · overly broad permissions
• d9 · 🟡 MEDIUM   · mooncake-p2p-store/src/p2pstore/go.mod, mooncake-common/etcd/go.mod:1 · golang.org/x/net@0.58.0 — 5 vulnerabilities (worst: GO-2026-6603)
• d7 · 🟡 MEDIUM   · .devcontainer/Dockerfile:29 · Downloaded Go tarball is not integrity-verified (no checksum comparison befor...

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.

 

[TechnoFinch]

Bumped golang.org/x/net v0.54.0 -> v0.61.0 (Broly CRITICAL) and x/text -> v0.43.0 in the http-metadata-server example. Tidy also moved x/crypto to v0.58.0, x/sys to v0.49.0 and the go directive to 1.26.0. Builds and vets clean with go1.26.10.