Lucas Manuel Rodriguez
703dcf0b4f
Resolves #48988. I ran `make update-go version=1.26.5`. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Fleet: <img width="301" height="102" alt="Screenshot 2026-07-09 at 8 41 49 AM" src="https://github.com/user-attachments/assets/baf76ce7-6192-4506-a9db-52f5318939ee" /> fleetctl: ``` fleetctl --version fleetctl - version orbit-v1.57.0-402-ge3d0c005dc branch: 48988-update-go-1.26.5 revision: e3d0c005dc6698c024ad47a124c99e4f264855a0 build date: 2026-07-09 build user: lucas go version: go1.26.5 ``` Also verified orbit in Linux: <img width="582" height="121" alt="Screenshot 2026-07-09 at 8 51 55 AM" src="https://github.com/user-attachments/assets/65672676-8010-45a1-8c28-9f9959e72134" /> ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the project and all included tooling modules to Go 1.26.5. * Refreshed build images used by desktop Linux, load testing, and related utilities to the newer Go toolchain. * Updated change log entries to reflect the Go version bump. * **Bug Fixes** * Improved the automation that refreshes Go-pinned Docker image references to resolve and apply correct digests, helping prevent broken build images. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Vulnerability scanning for inlined dependencies
This directory contains manifest files (go.mod, package.json) that list the third-party dependencies that have been copied/inlined into Fleet's codebase.
Purpose
Fleet has several dependencies that were copied directly into the repository rather than imported via Go modules or npm. These inlined dependencies are not automatically scanned by vulnerability detection tools like GitHub Dependabot because they don't appear in the main go.mod or package.json.
This directory solves that problem by creating "dummy" manifest files that list these dependencies at their copied versions. This allows:
- GitHub Dependabot to detect vulnerabilities and create alerts
- osv-scanner to scan for Go and npm vulnerabilities
- npm audit to scan for JavaScript vulnerabilities
- Other security scanning tools to identify issues
Important notes
- This code is NOT compiled into Fleet - These manifest files exist solely for vulnerability scanning
- Keep versions in sync - When updating an inlined dependency, update the version here to match
- No Go code here - Do not add any
.gofiles to this directory
Tracked dependencies
Go dependencies (go.mod)
| Dependency | Fleet Location | Version |
|---|---|---|
| micromdm/nanomdm | server/mdm/nanomdm/ | v0.9.0 |
| micromdm/nanodep | server/mdm/nanodep/ | v0.4.0 |
| micromdm/scep/v2 | server/mdm/scep/ | v2.3.0 |
| pressly/goose/v3 | server/goose/ | v3.17.0 |
| facebookincubator/nvdtools | server/vulnerabilities/nvd/tools/ | v0.1.5 |
| virtuald/go-paniclog | orbit/pkg/go-paniclog/ | v0.0.0-20190812204905-43a7fa316459 |
| josharian/impl | server/mock/mockimpl/ | v1.4.0 |
| mitchellh/gon | orbit/pkg/packaging/macos_notarize.go | v0.2.3 |
| sassoftware/relic | pkg/file/xar.go | v7.2.1+incompatible |
npm dependencies (package.json)
| Dependency | Fleet Location | Version |
|---|---|---|
| node-sql-parser | frontend/utilities/node-sql-parser/ | 5.3.13 |
Running vulnerability scans locally
Go and npm vulnerabilities
Since this directory contains no Go source files (by design), source-based tools like govulncheck ./... won't work. Use tools that scan go.mod directly:
Using osv-scanner (recommended):
go install github.com/google/osv-scanner/cmd/osv-scanner@latest
cd third_party/vuln-check
# To include npm dependencies in the scan, first generate a lock file:
npm i --package-lock-only
osv-scanner scan .