Repository navigation
Bump Go to 1.26.10 and patch activesupport, rack, addressable - #235
Conversation
govulncheck flags GO-2026-6809 in crypto/x509, fixed in go1.26.10; CI reads the toolchain from go/go.mod. Bundler Audit and Trivy flag activesupport 8.1.2.1, rack 3.2.6 and addressable 2.9.0; move each to the first patched release (8.1.4.1, 3.2.8, 2.9.2).
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
The hand-restored BUNDLED WITH left the lockfile inconsistent, and frozen bundle install on CI refused it.
There was a problem hiding this comment.
🟢 Approved
No active review issues are identified for the dependency and Go version updates.
No open issues 🎉
What changed in this PR
Updates Go and Ruby dependencies to address security advisories causing shared CI failures, including those affecting #233 and #234. No SDK behavior, spec, or generated code changes are included.
Changes:
- Raises Go from 1.26.9 to 1.26.10 across both modules and the workspace.
- Patches activesupport, rack, and addressable, with updated checksums.
- Updates the lockfile’s Bundler version from 4.0.13 to 4.0.20.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
ruby/Gemfile.lock |
Updates three gems, their checksums, and the Bundler version. |
go/go.mod |
Raises the SDK’s minimum Go version to 1.26.10. |
go.work |
Aligns the workspace with Go 1.26.10. |
conformance/runner/go/go.mod |
Aligns the conformance runner with Go 1.26.10. |
Review effort: Balanced
💡 Codex ReviewLine 223 in fe8d3f9  Synchronize the selected Bundler and its checksum
The Ruby CI matrix explicitly selects Bundler from this lockfile footer ( ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Review bodies: 1 finding answered (1 fixed).
|
The security workflow is red on every PR (including #233 and #234) because of new advisories, not anything those PRs changed. This fixes them at the source.
godirective ingo/go.mod,conformance/runner/go/go.modandgo.work; every workflow'ssetup-goreadsgo-version-file: go/go.mod, so CI picks it up with no workflow change.ruby/Gemfile.lockmoves activesupport 8.1.2.1 → 8.1.4.1, rack 3.2.6 → 3.2.8, addressable 2.9.0 → 2.9.2 (bundle update --conservative, nothing else moved;BUNDLED WITHleft at 4.0.13).Locally:
govulncheck ./...(v1.1.4, go1.26.10) reports no vulnerabilities;bundle-audit check --updatereports none; Go tests and the Ruby suite (117 runs) pass.No spec or generated code changes; nothing here needs a release on its own.
Summary by cubic
Fixes the security workflow that was failing on every PR due to new advisories unrelated to those PRs.
Bumps the Go toolchain from 1.26.9 to 1.26.10 across
go.work,go/go.mod, andconformance/runner/go/go.modto fix GO-2026-6809 (crypto/x509). CI picks this up automatically sincesetup-goreadsgo-version-file: go/go.mod.Applies a conservative
bundle updateinruby/Gemfile.lock, patching activesupport 8.1.2.1 → 8.1.4.1, rack 3.2.6 → 3.2.8, and addressable 2.9.0 → 2.9.2. Regenerated the lockfile with the locked Bundler (4.0.13), which a hand-editedBUNDLED WITHhad left inconsistent and failing frozen installs on CI.govulncheckandbundle-auditreport no vulnerabilities, and both test suites pass.Written for commit 4509a29. Summary will update on new commits.