From ae8c4ba7704fbf16b23b2ca5e1ac6b27a6c2d1af Mon Sep 17 00:00:00 2001 From: Ako Date: Fri, 9 Oct 2026 21:35:59 +0000 Subject: [PATCH] chore(devcontainer): build with go.mod's Go toolchain (1.27.2) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The devcontainer was on go:dev-1.26-bookworm while go.mod and CI moved to toolchain go1.27.2 (#1064) for five stdlib security fixes (GO-2026-6603..6608, fixed in 1.26.9 / 1.27.2). The image sets GOTOOLCHAIN=local, so local builds ignored the pin and used the image's Go: 1.26.4 here. Bumping the tag alone is not enough: dev-1.27-bookworm ships 1.27.1, which is still affected, and the image has no patch-level tags. So also set GOTOOLCHAIN=auto, letting go.mod's toolchain line — the same pin CI uses — select the version, now and on future bumps. Verified by building this Dockerfile and running `go version` against the repo's go.mod: this image GOTOOLCHAIN=auto go1.27.2 (downloaded) base image (control) GOTOOLCHAIN=local go1.27.1 Co-Authored-By: Claude Opus 5.5 --- .devcontainer/Dockerfile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 702fe6e1ff..46b3334927 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,5 +1,11 @@ # Mendix Model SDK Go - Development Container -FROM mcr.microsoft.com/devcontainers/go:dev-1.26-bookworm +FROM mcr.microsoft.com/devcontainers/go:dev-1.27-bookworm + +# The base image sets GOTOOLCHAIN=local, which ignores go.mod's `toolchain` +# line and builds with whatever Go the image ships. Its tags track minor +# versions only (dev-1.27 was 1.27.1 when go.mod moved to 1.27.2 for security +# fixes), so `auto` lets go.mod — the same pin CI uses — choose the toolchain. +ENV GOTOOLCHAIN=auto RUN rm -f /etc/apt/sources.list.d/yarn.list