Review: Go Docker image digest bump (Go 1.26.3 → 1.26.4)

Reviewed the golang:1.26-alpine digest bump in stacks/flow.Dockerfile. The new digest (f23e8b2) corresponds to Go 1.26.4 (released 2026-06-02), up from Go 1.26.3.

Upstream changes in Go 1.26.4

Security fixes:

• crypto/x509: High-CPU VerifyHostname behavior via repeated hostname splitting (DoS vector) — #79701
• mime: Quadratic complexity in WordDecoder.DecodeHeader (DoS vector) — #79230
• net/textproto: Arbitrary input included in errors without escaping — #79426

Bug fixes:

• cmd/compile: AMD64 SHL instruction overflow miscompilation — #79191
• runtime/race: Build failure on Amazon Linux 2 / arm64 — #79686
• cmd/fix: Side-effect hoisting in slicescontains — #79349
• crypto/internal/fips140/drbg: FIPS DRBG backport — #79226

Assessment

• No regressions identified in the upstream release notes or issue tracker.
• No PII/secrets concerns — change is a single digest hash in the Dockerfile.
• The security fixes (especially crypto/x509 and mime DoS vectors) are relevant to PeerDB's network-facing components.
• Recommendation: merge. This is a straightforward security patch release.

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Upstream dependency check (per REVIEW.md)

This PR updates the golang:1.26-alpine Docker base image digest, which most likely reflects the update to go1.26.4 (released 2026-06-02). Recent Go 1.26.x patch releases in scope:

All 1.26.x patches are security and bug fix releases only — no new features or breaking changes per Go's stable release policy. The security fixes are beneficial and no regressions are expected.

Assessment: Low-risk, routine dependency update. Safe to merge.

Source: Go Release History

Review: Dockerfile digest bumps

Reviewed the digest pin updates for golang:1.26-alpine and node:24-alpine in stacks/flow.Dockerfile and stacks/peerdb-ui.Dockerfile.

Changes:

• golang:1.26-alpine digest: 91eda97… → f23e8b2…
• node:24-alpine digest: 2bdb65e… → fb71d01…

Checks performed (per REVIEW.md):

1. PII / secrets: No sensitive data exposed — both Dockerfiles are unchanged beyond the digest pins. No passwords, tokens, or PII in build args, ENV vars, or log outputs.
2. Upstream regression check: These are digest-only updates (no semver version bump), meaning the base images were rebuilt — typically for Alpine security patches (OpenSSL, musl-libc, zlib) or minor Go/Node.js patch releases. Digest-only rebuilds carry very low regression risk since the tagged version (Go 1.26, Node 24) remains the same.

Verdict: Looks clean. Digest pin updates are the expected output of Renovate tracking base image rebuilds. No regressions identified.

🤖 Generated with Claude Code

Upstream release details (Go 1.26.4)

Follow-up with specific upstream findings for the golang:1.26-alpine digest bump:

The new digest corresponds to Go 1.26.4 (released June 2, 2026), which includes 3 security fixes:

1. CVE-2026-42504 (mime): Quadratic complexity in WordDecoder.DecodeHeader — malicious MIME headers could cause excessive CPU usage (DoS).
2. CVE-2026-42507 (net/textproto): Unsanitized input included in error messages, enabling log injection or terminal control character attacks.
3. CVE-2026-27145 (crypto/x509): Quadratic complexity in hostname verification with large SAN lists — another DoS vector.

No regressions have been reported for Go 1.26.4. This is the most stable 1.26.x patch release currently available.

Recommendation: Safe to merge — these are beneficial security patches with no known regressions.

🤖 Generated with Claude Code

Upstream release details (Node.js 24.16.0)

Findings for the node:24-alpine digest bump:

The new digest corresponds to Node.js 24.16.0 (LTS, released May 21, 2026), which includes:

Security improvements:

• OpenSSL upgraded to 3.5.6 (routine security patches)
• Crypto module fixes: unsigned conversion fix for 4-byte RSA publicExponent, rejection of inherited key type names
• ClientRequest options hardened to prevent conflicting headers from silently overwriting during redirects/proxy hops

Alpine base layer:

• Alpine 3.21.7 / 3.22.4 (April 2026) patched six OpenSSL CVEs (including CVE-2026-31790, CVE-2026-28387–28390), two musl CVEs, and two zlib CVEs

Known issues:

• There is a pre-existing performance regression in V8 CppHeap affecting Node 22/24, but this is not new to this bump.

Recommendation: Safe to merge — security-positive changes with no new regressions introduced by this update.

🤖 Generated with Claude Code