security: patch CVE-2026-111943 (#1382)

* security: patch CVE-2026-111943 (eMudhra CA compromise)

Bump Go to 1.26.10 and upgrade Alpine ca-certificates-bundle to 20261020-r0.

* security: patch volume-workspace image, lib go.mod, changelog for CVE-2026-111943

Author: andreeleuterio

CHANGELOG.md

@@ -15,6 +15,7 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Changed
 
+- Updated Go to 1.26.10 and the Alpine `ca-certificates-bundle` in Docker images to 20261020-r0 to stop trusting the compromised eMudhra CAs ([CVE-2026-111943](https://emudhra.we-have-a-problem.com/)).
 - HTTP requests now fail instead of hanging forever if the server does not start responding within 1 minute. Set the `SRC_RESPONSE_HEADER_TIMEOUT` environment variable to change this timeout, or to `0` to disable it. Responses that stream data for a long time (for example, large search job results) are not affected.
 - `src search-jobs logs` and `src search-jobs results` now use the standard API client, gaining proxy support, `-insecure-skip-verify`, and cross-host redirect protection, and now report an error on non-200 responses instead of writing the error page into the output.
 - The command list in `src help` is now generated from the registered commands instead of being maintained by hand. `src debug`, `src snapshot`, and `src lsp` now appear in it; aliases are shown after each description.

Dockerfile

@@ -4,17 +4,18 @@
 #
 # Nothing fancy here: we copy in the source code and build on the Alpine Go
 # image. Refer to .dockerignore to get a sense of what we're not going to copy.
-FROM golang:1.26.5-alpine3.23@sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc AS builder
+FROM golang:1.26.10-alpine3.23@sha256:a07f231c19b03e6106cf442f02a5bcf262147e744d15b7b5e4b6d81d420c70a0 AS builder
 
 COPY . /src
 WORKDIR /src
 RUN go build ./cmd/src
 
 # This stage should be kept in sync with Dockerfile.release.
-FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
 # needed for `src code-intel upload` and `src actions exec`
-RUN apk add --no-cache git
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle
 
 COPY --from=builder /src/src /usr/bin/
 ENTRYPOINT ["/usr/bin/src"]

Dockerfile.release

@@ -2,10 +2,11 @@
 # suitable for testing, since it depends on a src binary being at the project
 # root _and_ that src binary being runnable on Alpine. To test this, refer to
 # the main Dockerfile, which should have an identical second stage.
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
 # needed for `src code-intel upload` and `src actions exec`
-RUN apk add --no-cache git
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle
 
 COPY src /usr/bin/
 ENTRYPOINT ["/usr/bin/src"]

dev/vendor-lib.sh

@@ -136,7 +136,7 @@ echo "Creating go.mod file..."
 cat > "$DEST_LIB/go.mod" <<EOF
 module github.com/sourcegraph/sourcegraph/lib
 
-go 1.26.5
+go 1.26.10
 EOF
 
 # Create README.md

docker/batch-change-volume-workspace/Dockerfile

@@ -2,6 +2,7 @@
 # image that we use to run curl, git, and unzip against a Docker volume when
 # using the volume workspace.
 
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
-RUN apk add --update git unzip
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --update git unzip && apk upgrade --no-cache ca-certificates-bundle

go.mod

@@ -1,6 +1,6 @@
 module github.com/sourcegraph/src-cli
 
-go 1.26.5
+go 1.26.10
 
 require (
 	cloud.google.com/go/storage v1.50.0

lib/go.mod

@@ -1,6 +1,6 @@
 module github.com/sourcegraph/sourcegraph/lib
 
-go 1.26.5
+go 1.26.10
 
 require (
 	github.com/Masterminds/semver v1.5.0

mise.toml

@@ -1,4 +1,4 @@
 [tools]
-golang = "1.26.5"
+golang = "1.26.10"
 shfmt = "3.8.0"
 shellcheck = "0.10.0"