Update docker.io/library/golang Docker tag to v1.26.5 (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/golang	stage	patch	1.26.3 → 1.26.5

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:08 AM UTC · Completed 1:15 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile:19 — Dockerfile is a protected governance/infrastructure file that always requires human approval. This PR modifies it but has no linked issue providing authorization. The change itself is a routine Renovate patch bump of the Go build image (1.26.3 → 1.26.5 with pinned digest), which is low-risk — but protected-path policy requires explicit human sign-off regardless of change nature.
  Remediation: A human maintainer should review and approve this Dockerfile change. Consider linking a tracking issue or policy that authorizes automated Dockerfile updates to streamline future Renovate PRs.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] Dockerfile — Dockerfile is a protected path requiring human approval. This PR has no linked issue justifying the modification of governance/infrastructure files. While the change is a mechanical golang version bump (1.26.3 → 1.26.5) managed by Renovate/MintMaker, protected-path changes always require explicit human review regardless of the change nature.
  Remediation: A maintainer should review and approve this Dockerfile change. Consider linking a tracking issue or policy document that authorizes automated Dockerfile updates via Renovate.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [protected-path] Dockerfile:19 — Dockerfile is a protected infrastructure path that requires human approval for any modifications. This PR modifies the golang builder image tag and digest (1.26.3 → 1.26.5) but has no linked issue providing explicit authorization for this change. While the change is an automated Renovate dependency update from red-hat-konflux[bot], human review and approval is always required for protected-path changes.
  Remediation: A maintainer should review and approve this Dockerfile change.

Previous run (3)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected infrastructure file requiring human approval. The PR has no linked issue providing explicit authorization for this change. While the PR description indicates this is an automated Renovate dependency update (golang 1.26.3 → 1.26.5 with updated digest pin), protected-path changes require issue-level authorization regardless of the change's nature.
  Remediation: A human reviewer should explicitly approve this Dockerfile change. Consider linking a tracking issue that authorizes automated Dockerfile updates via Renovate.

Previous run (4)

Looks good to me — routine Golang base image patch bump (1.26.3 → 1.26.5) with pinned digest, generated by Renovate/MintMaker. No correctness, security, or style findings.

Note: Dockerfile is a protected path. Human approval is required for changes to this file regardless of automated review outcome.

Previous run (5)

Review

No substantive findings. The Golang builder image bump from 1.26.3 to 1.26.5 with pinned digest is a routine dependency update.

Dockerfile is a protected path — human approval is required regardless of change complexity.

Previous run (6)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR has no linked issue providing explicit authorization for changes to governance/infrastructure files. While the change is an automated Renovate dependency bump (golang 1.26.3 → 1.26.5 with pinned digest), human approval is always required for protected-path modifications.
  Remediation: A human reviewer should approve this change directly. If this is a routine dependency update authorized by the repository's renovate.json configuration, a maintainer can approve without a linked issue.

Previous run (7)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected infrastructure file requiring human approval. The PR has no linked issue authorizing changes to protected paths. The change itself is a standard Renovate-managed Go image patch bump (1.26.3 → 1.26.4) with digest pinning preserved, and renovate.json in the repository root configures this automation — but human review is always required for protected-path changes regardless of automation context.
  Remediation: A repository maintainer should review and approve this Dockerfile change.

Previous run (8)

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (9)

Review

Findings

High

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR has no linked issue providing explicit authorization for the change. This is a mechanical Renovate dependency bump (golang 1.26.3 → 1.26.4) with proper digest pinning — the change itself appears correct, but protected-path modifications always require human maintainer review regardless of the change's nature.
  Remediation: A human maintainer should review and approve this Dockerfile change. No code changes are needed — the dependency bump itself is straightforward.

Previous run (10)

Review — Approve ✅

Patch version bump of the Go Docker base image (1.26.3 → 1.26.5) in the build stage of the Dockerfile.

Summary

This is a mechanical, Renovate-generated dependency update that bumps the Go builder image by two patch versions. The change is a single-line tag swap with no behavioral, API, or architectural impact.

Correctness: No logic, edge-case, or build risks introduced. The go.mod directive (go 1.26.3) specifies a minimum Go version; building with 1.26.5 satisfies it. Other files referencing 1.26.3 (.tool-versions, Dockerfile.dist, module files) remain valid — patch versions are backward-compatible and will be updated by their own Renovate PRs.

Security: No secrets, permissions, workflows, or auth-related files are modified. The mutable-tag pattern (:1.26.5 without a digest pin) is consistent with the pre-existing convention; no new risk is introduced by this PR.

Intent & coherence: Automated patch maintenance by Renovate bot — authorization is implicit in the mechanical nature of the change and the project's configured auto-merge policy.

Style & conventions: The new value follows the identical major.minor.patch tag pattern as the previous value. No style deviation.

Documentation: No user-facing documentation references the specific Go builder image version. No staleness introduced.

No findings above the severity threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (11)

Review — ✅ Approve

PR: #3372 — Update docker.io/library/golang Docker tag to v1.26.4 (main)
Author: red-hat-konflux[bot] (Renovate / MintMaker)
Scope: 1 file changed, 1 addition, 1 deletion

Summary

Routine patch version bump of the Go build base image in the Dockerfile from golang:1.26.3 to golang:1.26.4. This is an automated dependency update created by the MintMaker/Renovate bot.

Analysis

Dimension	Result
Correctness	✅ Single-line tag bump in the build stage. Go patch versions are backward compatible. The go.mod directive (go 1.26.3) specifies minimum version and is fully compatible with the 1.26.4 toolchain.
Security	✅ Patch updates typically include bug and security fixes. Updating promptly is best practice.
Intent & coherence	✅ Standard automated dependency update. Well-scoped, single-purpose change.
Style & conventions	✅ Follows existing Dockerfile patterns. Tag-based reference is consistent with the build stage convention in this repo.
Documentation	✅ No documentation impact.
Cross-repo contracts	✅ No API, schema, or interface changes.

Findings

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (12)

Review — ✅ Approve

Scope: Automated patch version bump of Go Docker base image (1.26.3 → 1.26.5) in Dockerfile.

Summary

This is a single-line, automated Renovate/MintMaker dependency update that bumps the Go compiler Docker image tag from 1.26.3 to 1.26.5. Patch version updates deliver bug fixes and security patches with no breaking changes.

Analysis

Dimension	Assessment
Correctness	✅ Syntactically valid FROM instruction. go.mod specifies go 1.26.3 as minimum — building with 1.26.5 is fully compatible.
Security	✅ Patch releases include security fixes. No new attack surface. Net-positive change.
Intent & coherence	✅ Standard automated dependency update from red-hat-konflux[bot]. Branch name, labels, and PR body all consistent.
Style / conventions	✅ No changes to code style. Maintains existing Dockerfile format.
Documentation	✅ No documentation updates needed for a base image tag bump.
Cross-repo contracts	✅ No API, schema, or interface changes.

No findings above the severity threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (13)

Review — ✅ Approve

Scope: Automated patch version bump of the docker.io/library/golang Docker base image from 1.26.3 to 1.26.4 in Dockerfile.

Analysis

Dimension	Assessment
Correctness	Single-line base image tag bump. Go patch versions are backward compatible; building with Go 1.26.4 while go.mod specifies go 1.26.3 is fully supported. No logic changes.
Security	Patch updates typically include security and bug fixes — this update is beneficial.
Intent & coherence	Properly scoped automated Renovate update. Other version references (go.mod, .tool-versions, Dockerfile.dist) use different package managers or images (ubi9/go-toolset) and are managed by separate Renovate rules. No consistency issue.
Style	Matches existing Dockerfile conventions (full docker.io/library/ prefix, tag-only versioning).
Documentation	No documentation changes required.
Cross-repo contracts	Not applicable — no API or schema changes.

Notes

• The Dockerfile is the only file referencing docker.io/library/golang — no other files were missed.
• Dockerfile.dist uses a different base image (ubi9/go-toolset) with its own digest pin, managed separately.
• The go.mod files specify the Go language version directive, not the Docker image version — these are independently managed and the slight version difference is expected and safe.

No findings. Safe to merge.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (14)

Review of #3372 — Update docker.io/library/golang Docker tag to v1.26.5

Verdict: ✅ Approve

Summary

This is an automated patch version bump of the Go Docker build image from 1.26.3 to 1.26.5, generated by MintMaker/Renovate. The change modifies a single line in the Dockerfile.

Dimensions reviewed

Dimension	Findings
Correctness	✅ No issues — patch bump is compatible with go.mod minimum version (go 1.26.3 ≤ 1.26.5)
Security	✅ No issues — no secrets, injection vectors, auth/permission changes
Intent & coherence	✅ Mechanical dependency update; authorization implicit
Style & conventions	✅ Change follows existing Dockerfile patterns
Documentation currency	✅ No documentation references the Go version
Cross-repo contracts	✅ No exported interfaces or API surfaces modified

Notes

• The Go version in go.mod (1.26.3) is a minimum version directive and is compatible with the updated Docker image (1.26.5). Renovate typically updates these independently.
• The build stage uses a tag without a digest pin, while the final stage (ubi9/ubi-minimal) is digest-pinned. This is a pre-existing pattern, not introduced by this PR.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (15)

Review

Outcome: Approve

This PR is an automated Renovate/MintMaker dependency update that bumps the Go build image in Dockerfile from golang:1.26.3 to golang:1.26.5 (patch version).

Dimensions evaluated

Dimension	Result
Correctness	✅ No concerns — patch bump is backward-compatible with go.mod go 1.26.3 directive
Security	✅ No concerns — no secrets, injection vectors, or permission changes
Intent & coherence	✅ Mechanical dependency update, authorization implicit
Style & conventions	✅ Change follows existing Dockerfile patterns
Documentation currency	✅ No staleness — no new symbols, flags, or behavioral changes
Cross-repo contracts	⏭ Skipped — no exported interfaces modified

No findings at or above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (16)

Review

Outcome: Approve

Summary

Mechanical patch-version bump of the Go build image from golang:1.26.3 to golang:1.26.4 in Dockerfile, generated by MintMaker/Renovate. The change is a single-line value substitution that follows the existing pattern. No logic, security, API, or documentation concerns.

Findings

Severity	Category	File	Description
low	version-consistency	Dockerfile:19	The Dockerfile is bumped to golang:1.26.4, while Dockerfile.dist still uses go-toolset:1.26.3, and go.mod / .tool-versions also reference 1.26.3. For a Go patch release this is benign — go.mod's go directive is a minimum-version floor, and Renovate manages each dependency independently. No action needed on this PR; the other files will be updated by their own Renovate PRs.

Dimensions evaluated

• Correctness: No logic, edge-case, or test-integrity concerns. The only observation is the expected cross-file version skew noted above.
• Security: No secrets, injection patterns, permission changes, or supply-chain concerns introduced. The mutable tag (no digest pin) on the golang build image is a pre-existing pattern not introduced by this PR.
• Intent & coherence: Mechanical dependency bump by an automated bot. Authorization is implicit from the change's nature.
• Style & conventions: Value-only change follows existing Dockerfile pattern exactly.
• Documentation currency: No documentation impact.
• Cross-repo contracts: No exported interfaces or APIs modified.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

---

Labels: PR already has appropriate labels (dependencies, docker, renovate); adding go label since this is a Go compiler version bump.

Previous run (17)

Review of #3372 — Update docker.io/library/golang Docker tag to v1.26.4

Verdict: Approve ✅

Summary

This is a routine Renovate-automated patch version bump of the Go build image in Dockerfile, from golang:1.26.3 to golang:1.26.4. The change is a single-line tag update — no code, logic, or configuration changes.

Analysis

Dimension	Result
Correctness	✅ Tag format is consistent. Single-line change with no behavioral impact.
Security	✅ Go patch releases typically include security fixes — this is a positive change.
Intent & scope	✅ Appropriately scoped to Dockerfile only. Dockerfile.dist uses a different base image (ubi9/go-toolset) from a different registry and is managed separately.
Style/conventions	✅ Follows existing Renovate update patterns in this repo.
Documentation	✅ No documentation changes needed.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (18)

Review — #3372

Verdict: ✅ Approve

Summary

This is a single-line, automated patch version bump of the Go build image in Dockerfile from golang:1.26.3 to golang:1.26.4, generated by MintMaker/Renovate. The change is mechanically correct and introduces no logic, security, style, or documentation concerns.

Dimension Results

Dimension	Result	Notes
Correctness	✅ Pass (2 low)	Version skew with other Go version references is expected with separate Renovate rules
Security	✅ Pass	No secrets, injection vectors, or permission changes
Intent & Coherence	✅ Pass	Mechanical dependency bump; authorization implicit
Style & Conventions	✅ Pass	Value-only change follows existing pattern
Documentation	✅ Pass	No public symbols or behavioral changes
Cross-repo Contracts	⏭ Skipped	No exported interfaces modified

Low-severity Observations

1. Go version skew — Dockerfile.dist (Dockerfile, line 19): This PR bumps Dockerfile to Go 1.26.4 while Dockerfile.dist still uses ubi9/go-toolset:1.26.3 (pinned by digest). These are different base images managed by separate Renovate rules, so the temporary skew is expected and will resolve when the go-toolset:1.26.4 image is published and picked up.

2. Go version skew — go.mod / .tool-versions (Dockerfile, line 19): Several files (.tool-versions, go.mod, tools/go.mod, tools/kubectl/go.mod, acceptance/go.mod) still reference Go 1.26.3. These are managed independently and the patch-level discrepancy is benign for Go's compatibility guarantees.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

Previous run (19)

Review

Findings

High

• [protected-path] Dockerfile:19 — This PR modifies Dockerfile, which is a protected infrastructure file requiring human approval. The PR has no linked issue providing authorization for the change. While the PR is a Renovate-managed patch bump of the Go base image (1.26.3 → 1.26.4), protected-path changes always require explicit human review and approval regardless of the change's nature.
  Remediation: A human reviewer with infrastructure approval authority should verify and approve this Dockerfile change.

Previous run (20)

Review

Findings

Medium

• [protected-path] Dockerfile — This PR modifies Dockerfile, which is a protected path requiring human approval. The PR is an automated Renovate dependency update (golang 1.26.3 → 1.26.4) with a clear rationale in the PR body, but human review is always required for changes to governance and infrastructure files regardless of context.

---

Labels: PR modifies the Dockerfile to bump a dependency version.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:44 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:49 AM UTC · Completed 1:54 AM UTC
Commit: 7c8ccca · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:42 AM UTC
Commit: 8f05d87 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:33 AM UTC · Completed 1:38 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:57 AM UTC · Completed 2:04 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:45 AM UTC · Completed 1:52 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:46 AM UTC
Commit: 87c4a29 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:40 AM UTC · Completed 1:49 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:55 AM UTC · Completed 2:02 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:57 AM UTC · Completed 2:05 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:25 AM UTC · Completed 2:32 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:19 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] protected-path

Dockerfile is a protected governance/infrastructure file that always requires human approval. This PR modifies it but has no linked issue providing authorization for the change. The change is a routine Renovate patch bump of the Go build image (golang:1.26.3 → golang:1.26.5 with pinned sha256 digest), which is low-risk, but protected-path policy requires explicit human sign-off regardless of change nature.

Suggested fix: A human maintainer should review and approve this Dockerfile change. Consider linking a tracking issue or policy that authorizes automated Dockerfile updates to streamline future Renovate PRs.