security: patch volume-workspace image, lib go.mod, changelog for CVE-2026-111943

Author: andreeleuterio

CHANGELOG.md

@@ -15,6 +15,7 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Changed
 
+- Updated Go to 1.26.10 and the Alpine `ca-certificates-bundle` in Docker images to 20261020-r0 to stop trusting the compromised eMudhra CAs ([CVE-2026-111943](https://emudhra.we-have-a-problem.com/)).
 - HTTP requests now fail instead of hanging forever if the server does not start responding within 1 minute. Set the `SRC_RESPONSE_HEADER_TIMEOUT` environment variable to change this timeout, or to `0` to disable it. Responses that stream data for a long time (for example, large search job results) are not affected.
 - `src search-jobs logs` and `src search-jobs results` now use the standard API client, gaining proxy support, `-insecure-skip-verify`, and cross-host redirect protection, and now report an error on non-200 responses instead of writing the error page into the output.
 - The command list in `src help` is now generated from the registered commands instead of being maintained by hand. `src debug`, `src snapshot`, and `src lsp` now appear in it; aliases are shown after each description.

dev/vendor-lib.sh

@@ -136,7 +136,7 @@ echo "Creating go.mod file..."
 cat > "$DEST_LIB/go.mod" <<EOF
 module github.com/sourcegraph/sourcegraph/lib
 
-go 1.26.5
+go 1.26.10
 EOF
 
 # Create README.md

docker/batch-change-volume-workspace/Dockerfile

@@ -2,6 +2,7 @@
 # image that we use to run curl, git, and unzip against a Docker volume when
 # using the volume workspace.
 
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
-RUN apk add --update git unzip
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --update git unzip && apk upgrade --no-cache ca-certificates-bundle

lib/go.mod

@@ -1,6 +1,6 @@
 module github.com/sourcegraph/sourcegraph/lib
 
-go 1.26.5
+go 1.26.10
 
 require (
 	github.com/Masterminds/semver v1.5.0