From 53df6033d4888582b0ae0ff9cfefc803b4f94412 Mon Sep 17 00:00:00 2001 From: fullsend-code <278716306+fullsend-ai-coder[bot]@users.noreply.github.com> Date: Sun, 7 Jun 2026 15:13:15 +0000 Subject: [PATCH 1/3] fix(#1344): update Go version in code agent sandbox to 1.26.0 The sandbox image pinned Go 1.24.13 while go.mod requires 1.26.0. This version mismatch prevented the code agent from compiling or testing Go code, causing it to submit untested PRs (e.g. PR #1016 shipped a duplicate map key that go build would have caught). Update GO_VERSION from 1.24.13 to 1.26.0 and replace the SHA256 checksums for linux-amd64 and linux-arm64 archives. Checksums sourced from docker-library/golang at the go1.26.0 release commit. The sandbox image will rebuild automatically via the sandbox-images.yml workflow on push to main. Note: pre-commit could not run in-sandbox (exit 3) because the gitleaks hook tried to auto-download a newer Go toolchain, which is blocked by sandbox network policy. This is the same version mismatch this commit fixes. Closes #1344 --- images/code/Containerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index ac8b280daa..bd8fdd26d9 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -56,9 +56,9 @@ RUN git config --system http.sslCAInfo /etc/ssl/certs/ca-certificates.crt 2>/dev # # Pinned version + SHA256 checksum for supply chain safety. # To update: get the latest linux-{amd64,arm64} archive + sha256 from https://go.dev/dl/?mode=json -ARG GO_VERSION=1.24.13 -ARG GO_SHA256_AMD64=1fc94b57134d51669c72173ad5d49fd62afb0f1db9bf3f798fd98ee423f8d730 -ARG GO_SHA256_ARM64=74d97be1cc3a474129590c67ebf748a96e72d9f3a2b6fef3ed3275de591d49b3 +ARG GO_VERSION=1.26.0 +ARG GO_SHA256_AMD64=aac1b08a0fb0c4e0a7c1555beb7b59180b05dfc5a3d62e40e9de90cd42f88235 +ARG GO_SHA256_ARM64=bd03b743eb6eb4193ea3c3fd3956546bf0e3ca5b7076c8226334afe6b75704cd RUN case "$TARGETARCH" in \ amd64) GO_SHA="$GO_SHA256_AMD64" ;; \ From 71ea20d6a9b55b1d4c31862c812495e6c063fb6d Mon Sep 17 00:00:00 2001 From: Ralph Bean Date: Sun, 7 Jun 2026 13:47:39 -0400 Subject: [PATCH 2/3] fix(sandbox): bump gopls from 0.18.1 to 0.22.0 for Go 1.26 compat gopls 0.18.1 depends on golang.org/x/tools v0.30.x which fails to compile under Go 1.26.0 (invalid array length in tokeninternal.go). Bump to gopls 0.22.0, the latest release, which supports Go 1.26. Assisted-by: Claude claude-opus-4-6 Signed-off-by: Ralph Bean --- images/code/Containerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index bd8fdd26d9..d8a7091b56 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -77,7 +77,7 @@ ENV PATH="/usr/local/go/bin:${PATH}" \ # --------------------------------------------------------------------------- # gopls — Go language server for Claude Code LSP code intelligence. -ARG GOPLS_VERSION=0.18.1 +ARG GOPLS_VERSION=0.22.0 RUN GOBIN=/usr/local/go/bin go install "golang.org/x/tools/gopls@v${GOPLS_VERSION}" \ && gopls version From d735bee01aa627e8d12016f16488c310c011fc2b Mon Sep 17 00:00:00 2001 From: Ralph Bean Date: Mon, 8 Jun 2026 11:39:30 -0400 Subject: [PATCH 3/3] fix: remove trailing blank line in Containerfile Fixes end-of-file-fixer pre-commit hook failure. Assisted-by: Claude Opus 4.6 Signed-off-by: Ralph Bean --- images/code/Containerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index e1391c907a..d8a7091b56 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -122,4 +122,3 @@ COPY scan-secrets /usr/local/bin/scan-secrets RUN chmod +x /usr/local/bin/scan-secrets USER sandbox -