Skip to content

[v0.20.x-branch] Backport #11098: build: bump Go language to 1.25.13 and toolchain to 1.26.6 - #11103

Merged
ziggie1984 merged 2 commits into
lightningnetwork:v0.20.x-branchfrom
ziggie1984:backport-11098-to-v0.20.x-branch
Aug 20, 2026
Merged

[v0.20.x-branch] Backport #11098: build: bump Go language to 1.25.13 and toolchain to 1.26.6#11103
ziggie1984 merged 2 commits into
lightningnetwork:v0.20.x-branchfrom
ziggie1984:backport-11098-to-v0.20.x-branch

Conversation

@ziggie1984

@ziggie1984 ziggie1984 commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Backport of #11098

Opened manually rather than via the backport bot, since the change touches
.github/ files.

  • all tracked go.mod files move to go 1.25.13
  • release/toolchain pins move to Go 1.26.6 across Makefile, CI, Dockerfiles, golangci-lint config, and protobuf generation
  • install docs reference Go 1.25.13 with the official Linux amd64 and ARMv6 SHA256 checksums

Behaviour change reviewers should be aware of

Unlike the v0.21.x backport (#11101), this branch was on go 1.24.11, so the
go directive crosses a Go minor. That directive is what selects the GODEBUG
compatibility baseline compiled into the binary, so five defaults flip. Verified
on the built binary:

before (go 1.24.11):
  DefaultGODEBUG=containermaxprocs=0,cryptocustomrand=1,decoratemappings=0,
                 tlssecpmlkem=0,tlssha1=1,updatemaxprocs=0,urlstrictcolons=0,
                 x509sha256skid=0

after  (go 1.25.13):
  DefaultGODEBUG=cryptocustomrand=1,tlssecpmlkem=0,urlstrictcolons=0

What each dropped pin means for lnd:

Setting Effect Assessment
containermaxprocs, updatemaxprocs GOMAXPROCS now derives from cgroup CPU limits, and tracks changes to them The only operationally visible change. lnd never calls runtime.GOMAXPROCS; the five runtime.NumCPU() call sites (rpcserver.go, autopilot/top_centrality.go, fn/slice.go, sig pools) are unaffected, since NumCPU reads the affinity mask rather than the cgroup quota. Containerised nodes may see a different scheduler P count.
x509sha256skid Newly generated certs get a SHA-256 derived Subject Key ID cert/selfsigned.go omits SubjectKeyId with IsCA: true, so Go computes it. Cosmetic: the cert is self-signed and pinned by clients. Certs already on disk are untouched.
tlssha1 SHA-1 signature algorithms rejected in TLS 1.2 Inert. cert/tls.go already pins four non-SHA-1 suites with MinVersion: TLS1.2.
decoratemappings VMA naming on Linux Observability only.

All five remain overridable at runtime via the GODEBUG environment variable,
so an operator can restore the previous behaviour without a rebuild.

Additional fix: windows-arm -> windows-arm64 release target

Go 1.26 drops the 32-bit windows/arm port, so cross-compiling the windows-arm
release target fails once the toolchain moves to 1.26.6. The release matrix in
.github/workflows/main.yml and the target list in make/release_flags.mk are
switched to windows-arm64.

This mirrors master's #10838 (commit d3dad1690), which bundled the same arm64
switch into an earlier Go toolchain bump. That change was never backported to
v0.20.x, so it is carried here alongside the toolchain bump that requires it.
Added as its own commit for clarity.

Backport adaptations

Every hunk conflicted, since the branch was on go 1.24.11 / toolchain
1.25.5. Conflicts were resolved by taking the incoming version numbers; four
places needed manual attention:

  • Three files do not exist on this branch and are deliberately not
    introduced: .github/workflows/govulncheck.yml, actor/go.mod, and
    sqldb/v2/go.mod.

  • queue/go.mod — this branch keeps its go directive at the end of the
    file, while master has it at the top. The three-way merge produced a file with
    two go directives and dropped the require github.com/lightningnetwork/lnd/ticker
    line. Rewritten so the only change is the version.

  • kvdb/go.mod — the go directive sits after two replace directives
    (GHSA-25xm-hr59-7c27 and GO-2021-0053) that master no longer has in that
    position. The conflict region spanned them; restored explicitly.

  • mobile/README.md — this branch still referenced go1.17.6 via the old
    golang.org/dl URL. Master fixed that in an earlier bump that was never
    backported, so the line is brought up to date here rather than left stale.

Testing

  • make check-go-version — all Dockerfiles and YAML files report 1.26.6
  • GOTOOLCHAIN=go1.26.6 make build — lnd-debug and lncli-debug build and report 0.20.3-beta
  • GOTOOLCHAIN=go1.26.6 go build ./... in all 11 submodules — clean
  • go mod edit -json parses all 13 tracked go.mod files; each verified to contain exactly one go directive and to differ from the branch only in the version line
  • git diff --check — clean
  • no remaining 1.24.11 or 1.25.5 references in tracked files

@ziggie1984 ziggie1984 self-assigned this Aug 19, 2026
@github-actions github-actions Bot added the severity-critical Requires expert review - security/consensus critical label Aug 19, 2026
@github-actions

github-actions Bot commented Aug 19, 2026

Copy link
Copy Markdown

🔴 PR Severity: CRITICAL

file classification | 27 files | 78 lines changed

🔴 Critical (1 file)
  • sqldb/go.mod - under sqldb/*, which is always classified CRITICAL per the database-migration rule, even though this particular change is only a Go toolchain version bump
🟠 High (3 files)
  • cert/go.mod - under cert/* (auth/security-adjacent package)
  • lnrpc/Dockerfile - under lnrpc/* (RPC/API package)
  • lnrpc/gen_protos_docker.sh - under lnrpc/* (RPC/API package)
🟡 Medium (9 files)
  • go.mod - root module, uncategorized Go dependency file
  • fn/go.mod - under fn/*
  • tlv/go.mod - under tlv/*
  • tor/go.mod - under tor/*
  • kvdb/go.mod - under kvdb/*
  • queue/go.mod - uncategorized Go dependency file
  • ticker/go.mod - uncategorized Go dependency file
  • healthcheck/go.mod - uncategorized Go dependency file
  • clock/go.mod - uncategorized Go dependency file
🟢 Low (14 files)
  • .github/actions/setup-go/action.yml - CI configuration
  • .github/workflows/main.yml - CI configuration
  • .github/workflows/release.yaml - CI configuration
  • .golangci.yml - lint tooling configuration
  • Dockerfile - build/docker configuration
  • Makefile - build configuration
  • dev.Dockerfile - build/docker configuration
  • docker/btcd/Dockerfile - build/docker configuration
  • docs/INSTALL.md - documentation
  • make/builder.Dockerfile - build configuration
  • mobile/README.md - documentation
  • tools/Dockerfile - build/docker configuration
  • tools/go.mod - tooling dependency
  • tools/linters/go.mod - tooling dependency

Analysis

This PR is a mechanical Go toolchain/version bump (go 1.25.13 → 1.26.6) touching go.mod files, Dockerfiles, CI workflows, the Makefile, and docs across the repo — no application logic changes. It lands at CRITICAL for two reasons: (1) sqldb/go.mod falls under sqldb/*, which the always-CRITICAL database-migration rule applies to regardless of the actual content of the change, and (2) the PR touches 27 non-test files, exceeding the 20-file bump-up threshold. Despite the label, an expert reviewer should find this low-risk to actually review — it's purely a build/toolchain version update, not a functional or schema change.

To override, add a severity-override-{critical,high,medium,low} label.

@ziggie1984
build: replace windows-arm release target with windows-arm64
a144929 
Go 1.26 drops the 32-bit windows/arm port, so cross-compiling the
windows-arm release target fails once the toolchain moves to 1.26.6.
Switch the release matrix and release flags to windows-arm64, matching
what master did in lightningnetwork#10838 (commit d3dad16). That change bundled the
arm64 switch into a Go toolchain bump but was never backported to
v0.20.x, so it is carried here alongside the toolchain bump that
requires it.
@ziggie1984

ziggie1984 commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator Author

Heads up for reviewers: pushed one additional commit — a14492936 (build: replace windows-arm release target with windows-arm64).

Go 1.26 drops the 32-bit windows/arm port, so once this PR moves the toolchain to 1.26.6 the windows-arm release target fails to cross-compile. Master handled this in #10838 (commit d3dad1690), which folded the arm64 switch into an earlier Go toolchain bump, but that was never backported to v0.20.x — so it's carried here alongside the toolchain bump that requires it.

It's a two-line change (.github/workflows/main.yml release matrix + make/release_flags.mk), byte-identical to what master did, kept as its own commit for clarity. PR description updated with the details.

@ziggie1984
ziggie1984 merged commit 843d436 into lightningnetwork:v0.20.x-branch Aug 20, 2026
34 of 36 checks passed
@ziggie1984
ziggie1984 deleted the backport-11098-to-v0.20.x-branch branch August 20, 2026 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@starius starius starius approved these changes

Assignees

@ziggie1984 ziggie1984

Labels

severity-critical Requires expert review - security/consensus critical

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ziggie1984 @starius