build: bump Go toolchain to 1.26.3#10838
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request performs a comprehensive upgrade of the project's Go toolchain to version 1.26.3. The changes ensure consistency across the build environment, CI pipelines, and documentation. Additionally, it addresses the removal of the windows/arm port in newer Go versions by migrating to windows-arm64, ensuring continued cross-platform support. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
🟡 PR Severity: MEDIUM
🟡 Medium (1 file)
🟢 Low (16 files)
AnalysisThis PR appears to be a Go toolchain/version bump across the repository. All 17 files have small, uniform changes (1–2 lines each), consistent with updating a Go version string or toolchain reference in build and configuration files. The vast majority of files fall under LOW-severity categories (CI/CD configs, Dockerfiles, Makefiles, docs, and tool subdirectories). The only file that elevates severity above LOW is the root Bump check: Only 1 non-LOW file with 2 lines changed — no severity bump triggered. To override, add a |
ziggie1984
force-pushed
the
build-go-1.26.3
branch
from
3209467 to
e33251f
Compare
github-actions
Bot
added
severity-high
🟠 PR Severity: HIGH
🟠 High (2 files)
🟡 Medium (2 files)
🟢 Low (13 files)
AnalysisThis PR appears to be a Go version bump across the repository — updating the Go toolchain version in GitHub Actions workflows, Dockerfiles, Note: These two files are build/tooling files (a Docker container for generating protobufs and a shell script orchestrating that generation), not RPC API definitions themselves. A reviewer familiar with the Severity bump check: 17 non-test/non-generated files (< 20 threshold) and 59 lines changed (< 500 threshold) — no bump applied. To override, add a |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go version from 1.25.5 to 1.26.3 across the entire repository, including CI configurations, Dockerfiles, build scripts, and documentation. Additionally, the Windows ARM release target was updated to 64-bit to align with Go 1.26's platform support. I have no feedback to provide.
ziggie1984
changed the title
ziggie1984
force-pushed
the
build-go-1.26.3
branch
from
e33251f to
98ce3c7
Compare
github-actions
Bot
added
severity-critical
🔴 PR Severity: CRITICAL
🟠 High (4 files — base severity)
🟡 Medium (12 files)
🟢 Low (12 files)
AnalysisThis PR appears to be a Go version bump across the entire repository, updating The base severity is HIGH due to files in Note: Although the actual risk of a Go version bump is low, the automated classification rules are applied strictly by file path and file count thresholds. A reviewer with knowledge of the change scope may apply a To override, add a |
ziggie1984
force-pushed
the
build-go-1.26.3
branch
from
98ce3c7 to
9b69487
Compare
github-actions
Bot
added
severity-critical
|
/gemini review |
ziggie1984
force-pushed
the
build-go-1.26.3
branch
from
9b69487 to
4f5efd0
Compare
There was a problem hiding this comment.
Code Review
This pull request updates the Go toolchain and module versions across the repository, bumping the release version to 1.26.3 and the module versions to 1.25.10. The changes span Dockerfiles, CI configurations, documentation, and various sub-module go.mod files. Additionally, the Windows ARM release target was updated to windows-arm64. Feedback was provided to improve the maintenance instructions in the root go.mod file by adding a reminder to keep all sub-module versions in sync when making future updates.
ziggie1984
force-pushed
the
build-go-1.26.3
branch
from
4f5efd0 to
d17f260
Compare
github-actions
Bot
added
severity-critical
ziggie1984
force-pushed
the
build-go-1.26.3
branch
from
d17f260 to
56c2ddc
Compare
ziggie1984
force-pushed
the
build-go-1.26.3
branch
from
56c2ddc to
ebb2860
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request updates the Go version across the repository, bumping the release build toolchain to 1.26.3 and the module versions to 1.25.10 in various configuration files, Dockerfiles, and documentation. It also updates the Windows ARM release target to windows-arm64. A review comment correctly identified a missing sudo command in the ARMv6 installation instructions within docs/INSTALL.md, which would otherwise lead to permission errors during the extraction process.
| this version of Go. If it matches, then proceed to install Go: | ||
| ``` | ||
| sudo rm -rf /usr/local/go && tar -C /usr/local -xzf go1.25.5.linux-armv6l.tar.gz | ||
| sudo rm -rf /usr/local/go && tar -C /usr/local -xzf go1.25.10.linux-armv6l.tar.gz |
There was a problem hiding this comment.
The tar command in the ARMv6 installation instructions is missing sudo. Since it extracts files into /usr/local, it will likely fail due to insufficient permissions. This is inconsistent with the x86-64 instructions on line 112 which correctly include sudo for both the rm and tar commands.
| sudo rm -rf /usr/local/go && tar -C /usr/local -xzf go1.25.10.linux-armv6l.tar.gz | |
| sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.25.10.linux-armv6l.tar.gz |
1 participant
This PR replaces #10566 with a narrower Go version update that separates the build toolchain from the module language/minimum Go version.
The build toolchain pins move from Go 1.25.5 to Go 1.26.3 across:
The module language/minimum Go version stays on the Go 1.25 line and is updated only to the latest patch release:
go.modfiles now usego 1.25.10It also carries forward the compatibility fix discussed in #10566: Go 1.26 no longer supports the
windows/armport, so the release target and CI arm matrix now usewindows-arm64instead.This PR also adds a dedicated govulncheck workflow that builds the release-style
lndbinary and scans it in binary mode. The workflow runs weekly, can be started manually, and runs on PRs/pushes that touch Go dependency or Go build-version surfaces. This avoids making every ordinary PR fail because the external vulnerability database changed, while still catching newly published vulnerabilities on a schedule.No functional lnd code changes are included.