upgrade Go toolchain to 1.26.10 (CVE-2026-111943)

.devcontainer/Dockerfile

@@ -26,8 +26,8 @@
     pkg-config \
     patchelf
 
-RUN wget https://go.dev/dl/go1.22.12.linux-amd64.tar.gz \
-    && tar -C /usr/local -xzf go1.22.12.linux-amd64.tar.gz
+RUN wget https://go.dev/dl/go1.26.10.linux-amd64.tar.gz \
+    && tar -C /usr/local -xzf go1.26.10.linux-amd64.tar.gz
 
 RUN git clone https://github.com/alibaba/yalantinglibs.git \
     && cd yalantinglibs \

.github/workflows/ci.yml

@@ -1,227 +1,229 @@
 name: 'Build & Test (Linux)'
 
 on:
   push:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
     types: [opened, synchronize, reopened, labeled]
 
 
 jobs:
   build:
     if: >-
       github.event_name == 'push' ||
       github.event.action == 'opened' ||
       contains(github.event.pull_request.labels.*.name, 'run-ci')
     runs-on: ubuntu-22.04
     strategy:
       matrix:
         python-version: ['3.10', '3.12']
     env:
       CI: "true"
       SCCACHE_GHA_ENABLED: "true"
 
     steps:
     - uses: actions/checkout@v4
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
 
     - name: Install and start etcd
       run: |
         wget https://github.com/etcd-io/etcd/releases/download/v3.6.1/etcd-v3.6.1-linux-amd64.tar.gz
         tar xzf etcd-v3.6.1-linux-amd64.tar.gz
         sudo mv etcd-v3.6.1-linux-amd64/etcd* /usr/local/bin/
         etcd --advertise-client-urls http://127.0.0.1:2379 --listen-client-urls http://127.0.0.1:2379 &
         sleep 3 # Give etcd time to start
         etcdctl --endpoints=http://127.0.0.1:2379 endpoint health
       shell: bash
 
     - name: Free up disk space
       run: |
         sudo rm -rf /usr/share/dotnet
         sudo rm -rf /opt/ghc
         sudo rm -rf /opt/hostedtoolcache/CodeQL
 
     - name: Install CUDA Toolkit
       uses: Jimver/cuda-toolkit@v0.2.24
       with:
         cuda: '12.8.1'
         linux-local-args: '["--toolkit"]'
         method: 'network'
         sub-packages: '["nvcc"]'
 
     - name: Install coverage tools
       run: |
         sudo apt-get update
         sudo apt-get install -y lcov gcovr
 
     - name: Set up coverage compilation flags
       run: |
         echo "Setting up coverage compilation flags..."
         echo "CXXFLAGS=--coverage" >> $GITHUB_ENV
         echo "CFLAGS=--coverage" >> $GITHUB_ENV
         echo "LDFLAGS=--coverage" >> $GITHUB_ENV
       shell: bash
 
     - name: Run sccache-cache
       uses: mozilla-actions/sccache-action@v0.0.9
 
     - name: Configure sccache
       uses: actions/github-script@v7
       with:
         script: |
           core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
           core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
     - name: Run sccache stat for check
       shell: bash
       run: ${SCCACHE_PATH} --show-stats
 
     - name: Configure project with coverage support
       run: |
         sudo apt update -y
         sudo bash -x dependencies.sh -y
         mkdir build
         cd build
         cmake .. -DUSE_HTTP=ON -DUSE_CXL=ON -DUSE_ETCD=ON -DSTORE_USE_ETCD=ON -DENABLE_ASAN=ON -DENABLE_SCCACHE=ON -DCMAKE_BUILD_TYPE=Debug
       shell: bash
 
     - name: Build project
       run: |
         cd build
         make -j4
         sudo make install
       shell: bash
 
     - name: Build nvlink_allocator.so
       run: |
         mkdir -p build/mooncake-transfer-engine/nvlink-allocator
         cd mooncake-transfer-engine/nvlink-allocator
         export LIBRARY_PATH=/usr/local/cuda/lib64/stubs:$LIBRARY_PATH
         bash build.sh ../../build/mooncake-transfer-engine/nvlink-allocator/
       shell: bash
 
     - name: Start Metadata Server
       run: |
         cd mooncake-transfer-engine/example/http-metadata-server-python
         pip install aiohttp
         python ./bootstrap_server.py &
       shell: bash
 
     - name: Test (in build env) with coverage
       run: |
         cd build
         export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib
         ldconfig -v || echo "always continue"
         MC_METADATA_SERVER=http://127.0.0.1:8080/metadata DEFAULT_KV_LEASE_TTL=500 make test -j ARGS="-V"
       shell: bash
 
     - name: Generate coverage report
       id: coverage
       run: |
         cd build
         echo "=== Starting coverage report generation ==="
         echo "Current directory: $(pwd)"
 
         echo "=== Looking for .gcda files ==="
         find . -name "*.gcda" 2>/dev/null | head -10 || echo "No .gcda files found"
 
         echo "=== Running lcov ==="
         lcov --capture --directory . --output-file coverage.info 2>&1 || {
           echo "WARNING: lcov failed to capture coverage data"
           echo "Creating minimal lcov-compliant coverage file to allow CI to continue"
           echo "TN:dummy" > coverage.filtered.info
           echo "SF:/dev/null" >> coverage.filtered.info
           echo "DA:0,0" >> coverage.filtered.info
           echo "end_of_record" >> coverage.filtered.info
           echo "coverage_failed=true" >> $GITHUB_OUTPUT
           exit 0  # Exit successfully, do not block CI
         }
 
         echo "=== Processing coverage data ==="
         lcov --remove coverage.info '/usr/*' '*/test/*' '*/third_party/*' --output-file coverage.filtered.info 2>&1 || true
 
         echo "=== Generating HTML report ==="
         genhtml coverage.filtered.info --output-directory coverage_report 2>&1 || echo "genhtml failed, continuing..."
 
         echo "=== Coverage summary ==="
         lcov --list coverage.filtered.info 2>&1 || echo "lcov list failed"
 
         echo "=== Coverage report generation completed ==="
       shell: bash
 
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v4
       with:
         files: build/coverage.filtered.info
         flags: unittests
         name: code-coverage-report
         token: ${{ secrets.CODECOV_TOKEN }}
         fail_ci_if_error: false
       continue-on-error: true
 
     - name: Check coverage status
       if: always()
       run: |
         if [ "${{ steps.coverage.outputs.coverage_failed }}" = "true" ]; then
           echo "⚠️ Coverage collection failed but CI continued"
           echo "::warning::Code coverage collection failed. Please check the build logs."
         else
           echo "✅ Coverage collected successfully"
         fi
 
     - name: Generate Python version tag
       id: generate_tag_build
       run: |
         echo "python_version_tag=$(echo ${{ matrix.python-version }} | tr -d '.')" >> $GITHUB_OUTPUT
       shell: bash
 
     # In CI, build_wheel.sh removes build/ to free disk (CI=true); set FREE_BUILD_DIR=1 locally to enable.
     - name: Build Python wheel
       run: |
         PYTHON_VERSION=${{ matrix.python-version }} OUTPUT_DIR=dist-py${{ steps.generate_tag_build.outputs.python_version_tag }} ./scripts/build_wheel.sh
       shell: bash
 
     - name: Upload wheel for ZMQ test job
       uses: actions/upload-artifact@v4
       with:
         name: wheel-build-py${{ steps.generate_tag_build.outputs.python_version_tag }}
         path: mooncake-wheel/dist-py${{ steps.generate_tag_build.outputs.python_version_tag }}/*.whl
 
   build-musa:
     if: >-
       github.event_name == 'push' ||
       github.event.action == 'opened' ||
       contains(github.event.pull_request.labels.*.name, 'run-ci')
     runs-on: ubuntu-22.04
     container: mthreads/musa:rc4.3.0-devel-ubuntu22.04-amd64
     steps:
     - uses: actions/checkout@v4
 
     - name: Mark repository as safe
       run: git config --global --add safe.directory $GITHUB_WORKSPACE
       shell: bash
 
     - name: Configure project
       run: |
         apt update -y
+        apt-get install -y --only-upgrade ca-certificates
+        dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816
         bash -x dependencies.sh -y
         mkdir build
         cd build
         cmake .. -DUSE_MUSA=ON -DUSE_MNNVL=ON -DUSE_ETCD=ON -DSTORE_USE_ETCD=ON -DUSE_CXL=ON -DUSE_TCP=ON -DBUILD_UNIT_TESTS=OFF -DBUILD_EXAMPLES=OFF
       shell: bash
 
     - name: Build project
       run: |
         cd build
         source ~/.bashrc
         make -j4
         make install
       shell: bash
 
   test-wheel-ubuntu:
     needs: build-flags

dependencies.sh

@@ -23,7 +23,7 @@ NC="\033[0m" # No Color
 # Configuration
 REPO_ROOT=`pwd`
 GITHUB_PROXY=${GITHUB_PROXY:-"https://github.com"}
-GOVER=1.23.8
+GOVER=1.26.10
 YALANTINGLIBS_VERSION=0.5.7
 
 # Function to print section headers

docker/mooncake.Dockerfile

@@ -8,6 +8,14 @@ ARG UBUNTU_VERSION=22.04
 
 FROM nvidia/cuda:${CUDA_VERSION}-devel-ubuntu${UBUNTU_VERSION} AS builder
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1
 
@@ -71,13 +79,22 @@ RUN OUTPUT_DIR=dist ./scripts/build_wheel.sh
 ###############################################################################
 FROM nvidia/cuda:${CUDA_VERSION}-runtime-ubuntu${UBUNTU_VERSION} AS runtime
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1
 
 # Install runtime dependencies required by Mooncake
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        ca-certificates \
         python3 \
         python3-pip \
         ibverbs-providers \

docker/musa.Dockerfile

@@ -8,6 +8,14 @@ ARG UBUNTU_VERSION=22.04
 
 FROM mthreads/musa:${MUSA_VERSION}-devel-ubuntu${UBUNTU_VERSION}-amd64 AS builder
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1
 
@@ -61,13 +69,22 @@ RUN OUTPUT_DIR=dist ./scripts/build_wheel.sh
 ###############################################################################
 FROM mthreads/musa:${MUSA_VERSION}-devel-ubuntu${UBUNTU_VERSION}-amd64 AS runtime
 
+# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket
+# until the upstream base image is rebuilt; fail if it is still old.
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; }
+
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1
 
 # Install runtime dependencies required by Mooncake
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        ca-certificates \
         python3 \
         python3-pip \
         ibverbs-providers \

monitoring/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   prometheus:
-    image: prom/prometheus:v2.54.0
+    image: prom/prometheus:v3.15.1
     container_name: prometheus
     restart: unless-stopped
     ports:
@@ -20,7 +20,8 @@ services:
       - monitoring
 
   grafana:
-    image: grafana/grafana-oss:11.0.0
+    build: ./grafana
+    image: mooncake-grafana:13.2.4
     container_name: grafana
     restart: unless-stopped
     ports:

monitoring/grafana/Dockerfile

@@ -0,0 +1,9 @@
+FROM grafana/grafana:13.2.4
+
+# CVE fix: pull the patched ca-certificates from the Alpine repo until the
+# upstream image is rebuilt; fail if it is still old.
+USER root
+RUN apk upgrade --no-cache ca-certificates && \
+    v="$(apk info -e -v ca-certificates | sed 's/^ca-certificates-//')" && \
+    [ "$(apk version -t "$v" 20261020-r0)" != "<" ] || { echo "ca-certificates $v is older than 20261020-r0" >&2; exit 1; }
+USER 472

monitoring/run.sh

@@ -23,13 +23,14 @@ docker run -d \
   -p 9090:9090 \
   -v "$SCRIPT_DIR/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml" \
   --add-host host.docker.internal:host-gateway \
-  prom/prometheus:v2.54.0 \
+  prom/prometheus:v3.15.1 \
   --config.file=/etc/prometheus/prometheus.yml \
   --storage.tsdb.retention.time=15d \
   --web.console.libraries=/usr/share/prometheus/console_libraries \
   --web.console.templates=/usr/share/prometheus/consoles
 
 echo "Starting Grafana..."
+docker build -t mooncake-grafana:13.2.4 "$SCRIPT_DIR/grafana" || exit 1
 docker run -d \
   --name grafana \
   --restart unless-stopped \
@@ -41,7 +42,7 @@ docker run -d \
   -v grafana-data:/var/lib/grafana \
   -v "$SCRIPT_DIR/grafana/provisioning:/etc/grafana/provisioning" \
   -v "$SCRIPT_DIR/grafana/dashboards:/etc/grafana/dashboards" \
-  grafana/grafana-oss:11.0.0
+  mooncake-grafana:13.2.4
 
 echo "Monitoring stack started!"
 echo "Prometheus: http://localhost:9090"

mooncake-common/etcd/go.mod

@@ -1,27 +1,26 @@
 module github.com/kvcache-ai/Mooncake/mooncake-common/etcd
 
-go 1.23.0
+go 1.25.0
 
-toolchain go1.23.7
+toolchain go1.26.10
 
-require go.etcd.io/etcd/client/v3 v3.5.21
+require go.etcd.io/etcd/client/v3 v3.5.33
 
 require (
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.21 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.33 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.33 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.17.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/grpc v1.59.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )

mooncake-p2p-store/src/p2pstore/go.mod

@@ -1,27 +1,26 @@
 module github.com/kvcache-ai/Mooncake/mooncake-p2p-store/src/p2pstore
 
-go 1.23.0
+go 1.25.0
 
-toolchain go1.24.1
+toolchain go1.26.10
 
-require go.etcd.io/etcd/client/v3 v3.5.15
+require go.etcd.io/etcd/client/v3 v3.5.33
 
 require (
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.15 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.15 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.33 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.33 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.17.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/grpc v1.59.0 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )

mooncake-transfer-engine/example/http-metadata-server/go.mod

@@ -1,8 +1,8 @@
 module github.com/kvcache-ai/Mooncake/mooncake-transfer-engine/example/http-metadata-server
 
-go 1.23.0
+go 1.26.0
 
-toolchain go1.23.8
+toolchain go1.26.10
 
 require github.com/gin-gonic/gin v1.10.0
 
@@ -27,10 +27,10 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	golang.org/x/arch v0.8.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	google.golang.org/protobuf v1.34.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )