chore(deps): bump github.com/docker/secrets-engine/x to v0.2.1-do.not.use - #538
Merged
kgprs merged 3 commits intoJul 20, 2026
Conversation
….use docker/secrets-engine@x/v0.1.0-do.not.use...x/v0.2.1-do.not.use - fix(deps): bump Go 1.25.11 -> 1.25.12 for CVE-2026-39822, CVE-2026-42505 - feat(accesscontrol): add access control API for secret resolution - feat(plugins): add AccessControlModule plugin metadata type - feat(accesscontrol): add Go access control interface and signing info types - chore: add license headers to accesscontrol files
The Dockerfile pinned GO_VERSION=1.25.11 while go.mod required go 1.25.12, causing golangci-lint to fail with a GOTOOLCHAIN=local version mismatch. Extract the Go version from go.mod in the Makefile and pass it as a build-arg so go.mod is the single source of truth. Also wire GO_VERSION through docker-bake.hcl (_base now inherits _common) so bake-based targets (docs, push-mcp-gateway) stay in sync.
The validate workflow calls docker/bake-action directly (not via the Makefile), so the exported GO_VERSION never reached it and the bake GO_VERSION variable fell back to null, using the Dockerfile ARG default of 1.25.11. With go.mod requiring go 1.25.12, docs generation failed with a GOTOOLCHAIN=local version mismatch. - Derive GO_VERSION from go.mod in validate.yml and export it to the environment; bake-action picks it up for the GO_VERSION variable. - Bump the Dockerfile ARG GO_VERSION default to 1.25.12 as a fallback for any invocation that doesn't set the build-arg.
Benehiko
approved these changes
Jul 20, 2026
kgprs
deleted the
secrets-engine-releaser-bump-20260720-075351-3cf73a32-secrets-engine
branch
July 20, 2026 14:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated dependency bump from the secrets-engine release pipeline.
github.com/docker/secrets-engine/x:v0.1.0-do.not.use→v0.2.1-do.not.useDiff: docker/secrets-engine@x/v0.1.0-do.not.use...x/v0.2.1-do.not.use
Updated: go.mod
Commits
🤖 Opened by
secrets-engine-releaser. Review and merge to continue the release cascade.cc @joe0BAB @Benehiko — author and reviewers of the release PR.