fix(kamaji): rebuild image to pick up Go stdlib security fixes

The shipped kamaji binary was compiled with go1.26.3, which trivy flags
for the standard-library CVEs fixed in go1.26.4: crypto/x509
CVE-2026-27145, mime CVE-2026-42504, and net/textproto CVE-2026-42507.
The image base is distroless/static, so the remaining OS-package CVEs
from the scan do not apply to it.

Advance the build source from 26.3.5-edge to 26.3.6-edge, the next
patch on the same edge line (identical k8s.io/api v0.35.0 and
controller-runtime v0.22.4, staying clear of the k8s 1.36 line that
regresses tenant control-plane RBAC). The version change busts the
build-layer cache so the release rebuild compiles against the current
golang:1.26 toolchain, which resolves to 1.26.4 and closes the stdlib
CVEs.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
This commit is contained in:
Aleksei Sviridkin committed 2026-06-24 19:49:16 +03:00
1 parent 29bf56f550
commit 7e4af79b31
1 file changed
+1 -1
@@ -1,7 +1,7 @@
# Build the manager binary
FROM golang:1.26 AS builder
ARG VERSION=26.3.5-edge
ARG VERSION=26.3.6-edge
ARG TARGETOS
ARG TARGETARCH