From 7e4af79b3151ddfe430ce98b35b971e24c1f232d Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 24 Jun 2026 19:49:16 +0300 Subject: [PATCH] fix(kamaji): rebuild image to pick up Go stdlib security fixes The shipped kamaji binary was compiled with go1.26.3, which trivy flags for the standard-library CVEs fixed in go1.26.4: crypto/x509 CVE-2026-27145, mime CVE-2026-42504, and net/textproto CVE-2026-42507. The image base is distroless/static, so the remaining OS-package CVEs from the scan do not apply to it. Advance the build source from 26.3.5-edge to 26.3.6-edge, the next patch on the same edge line (identical k8s.io/api v0.35.0 and controller-runtime v0.22.4, staying clear of the k8s 1.36 line that regresses tenant control-plane RBAC). The version change busts the build-layer cache so the release rebuild compiles against the current golang:1.26 toolchain, which resolves to 1.26.4 and closes the stdlib CVEs. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/kamaji/images/kamaji/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile index 4dd0bb3ff..b67f934f0 100644 --- a/packages/system/kamaji/images/kamaji/Dockerfile +++ b/packages/system/kamaji/images/kamaji/Dockerfile @@ -1,7 +1,7 @@ # Build the manager binary FROM golang:1.26 AS builder -ARG VERSION=26.3.5-edge +ARG VERSION=26.3.6-edge ARG TARGETOS ARG TARGETARCH