From 5b485721603f9edba52f3b5f9873a4724bdaa5b1 Mon Sep 17 00:00:00 2001
From: tiffanny29631 <peip@google.com>
Date: Mon, 26 Oct 2026 20:14:18 +0000
Subject: [PATCH 1/2] chore: bump Go version to 1.26.10

Bump GOLANG_IMAGE_VERSION from 1.26.4 to 1.26.10 to fix CVE-2026-111943.

Bug: b/576935996
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 360cb40362..c726b07305 100644
--- a/Makefile
+++ b/Makefile
@@ -38,7 +38,7 @@ GO_DIR := $(OUTPUT_DIR)/go
 
 # Base image used for all golang containers
 # Uses trusted google-built golang image
-GOLANG_IMAGE_VERSION := 1.26.4
+GOLANG_IMAGE_VERSION := 1.26.10
 GOLANG_IMAGE := google-go.pkg.dev/golang:$(GOLANG_IMAGE_VERSION)
 # Base image used for debian containers
 # When updating you can use this command:

From 1c9a0257e4a6d7b01cb3b8a53aea44837a204204 Mon Sep 17 00:00:00 2001
From: tiffanny29631 <peip@google.com>
Date: Tue, 27 Oct 2026 21:17:51 +0000
Subject: [PATCH 2/2] fix: silence SC2295 for the intentional glob in
 update-component-image.sh

lint-bash fails in this PR's presubmit, which builds a new buildenv for
go1.26.10: shellcheck reports SC2295 on
BASE_VERSION=${CURRENT_TAG%${STRIP_BASE_PATTERN}}.

STRIP_BASE_PATTERN is meant to be a glob (for example "-gke.*__linux_amd64").
Quoting the expansion as shellcheck suggests would match it literally, so
v4.5.0-gke.5__linux_amd64 would no longer reduce to v4.5.0 and
UPDATE_TYPE=latest-build would stop finding new -gke.N builds. Keep the
glob and disable SC2295 for this line.
---
 scripts/update-component-image.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/update-component-image.sh b/scripts/update-component-image.sh
index f57a36ac3b..2dc2ebc485 100755
--- a/scripts/update-component-image.sh
+++ b/scripts/update-component-image.sh
@@ -97,6 +97,8 @@ elif [[ "${UPDATE_TYPE}" == "latest-build" ]]; then
   if [[ "${COMPONENT}" == "debian-base" ]]; then
     BASE_VERSION=$(echo "${CURRENT_TAG}" | sed -E "s/${STRIP_BASE_PATTERN}//")
   else
+    # STRIP_BASE_PATTERN is a glob (e.g. "-gke.*"), so it must stay unquoted.
+    # shellcheck disable=SC2295
     BASE_VERSION=${CURRENT_TAG%${STRIP_BASE_PATTERN}}
   fi
   FILTER="tags:${BASE_VERSION}*"