[CSCITech]

⚠️ 提交说明 / PR Notice

本 PR 将后端安全构建基线统一到 Go 1.26.10，以纳入 CVE-2026-111943 的证书校验修补。现有部署仍需重新构建并替换二进制；本 PR 不执行线上升级。

📝 变更描述 / Description

此前 Docker builder 固定 Go 1.26.1，而源码模块、发行和 Electron 工作流的版本约束也未明确保证本次补丁。现在 go.mod 与 Heroku 标记采用 Go 1.26.10，两个 Docker builder 固定同一已核验的官方镜像 digest，CI/release/Electron 共 5 个 setup-go 步骤统一读取 go.mod。实际构建增加产物 go version -m 输出，CI 输出 Go 版本。

同步六份根 README、Electron 构建说明及 AGENTS/CLAUDE 技术基线，明确仅安装新版 Go、重启旧二进制或只重新包装 Electron 都不能更新后端内嵌标准库。最终差异为 15 个构建/说明文件；保留 main 已有目录功能和前端构建检查，不改业务 Go 源码、产品依赖、计费、数据库或 TLS 验证设置。

🚀 变更类型 / Type of change

• 🐛 Bug 修复 (Bug fix) — 上游工具链已确认的 CVE 修补，依据见下方官方记录。
• ✨ 新功能 (New feature)
• ⚡ 性能优化 / 重构 (Refactor)
• 📝 文档更新 (Documentation)

🔗 关联任务 / Related Issue

• Go 官方 1.26 分支回移记录 #82348
• Go 官方原始安全问题 #82345

未关联本仓库 Issue；不新建占位 Issue 或用无关 Issue 充数。

✅ 提交前检查项 / Checklist

• 人工确认: 我已亲自整理并撰写此描述，没有直接粘贴未经处理的 AI 输出。
• 非重复提交: 我已搜索现有的 Issues 与 PRs，确认不是重复提交。
• Bug fix 说明: 已核对上游 CVE 与关联官方 Issue，确认属于实际工具链缺陷修补。
• 变更理解: 我已理解这些更改的工作原理及可能影响。
• 范围聚焦: 本 PR 未包含与当前任务无关的代码改动。
• 本地验证: 已在本地运行并通过匹配范围的验证，维护者可据下方结果复核。
• 安全合规: 变更未引入敏感凭据，并符合项目代码规范。

以上确认项留给维护者审核勾选，不代作人工声明。自动化和本地验证的实际结果如下。

📸 运行证明 / Proof of Work

• 本 PR head b2745bbaa9113a11dbe55c03eb4faf0ee213195e 的 CI：Backend checks、Frontend checks 均成功；PR Check 成功。
• 同一整合源码树本地 go test -p 4 -json ./...：59 个有测试包通过、36 个无测试包；go vet -p 4 ./...、JSON wrapper policy（113 条 allowlist）、YAML 与 diff 检查通过。
• 本地 Windows/amd64、Linux/amd64 的 CGO=0 构建通过，两份产物的编译器记录均为 Go1.26.10。官方 Go Docker index digest 及 amd64 子 manifest/config 已校验。
• 未实际构建 Docker 镜像、运行各平台原生/CGO 发行构建或部署到生产；不能据本 PR 声称线上实例已升级，也不声称所有依赖已无漏洞。其他已记录的依赖告警继续作为独立评审事项。

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b47d7ec7-7398-484c-b30f-39ed33be6a87

📥 Commits

Reviewing files that changed from the base of the PR and between b2f25b0 and b2745bb.

📒 Files selected for processing: 15

• .github/workflows/ci.yml
• .github/workflows/electron-build.yml
• .github/workflows/release.yml
• AGENTS.md
• CLAUDE.md
• Dockerfile
• Dockerfile.dev
• README.en.md
• README.fr.md
• README.ja.md
• README.md
• README.zh_CN.md
• README.zh_TW.md
• electron/README.md
• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🪛 actionlint (1.7.12)

.github/workflows/release.yml

[error] 46-46: shellcheck reported issue in this script: SC2086:info:2:121: Double quote to prevent globbing and word splitting

(shellcheck)

[error] 51-51: shellcheck reported issue in this script: SC2086:info:3:190: Double quote to prevent globbing and word splitting

(shellcheck)

[error] 101-101: shellcheck reported issue in this script: SC2086:info:2:99: Double quote to prevent globbing and word splitting

(shellcheck)

[error] 152-152: shellcheck reported issue in this script: SC2086:info:2:99: Double quote to prevent globbing and word splitting

(shellcheck)

🪛 Checkov (3.3.20)

Dockerfile.dev

[low] 1-36: Ensure that HEALTHCHECK instructions have been added to container images

(CKV_DOCKER_2)

[low] 1-36: Ensure that a user for the container has been created

(CKV_DOCKER_3)

Dockerfile

[low] 1-45: Ensure that HEALTHCHECK instructions have been added to container images

(CKV_DOCKER_2)

[low] 1-45: Ensure that a user for the container has been created

(CKV_DOCKER_3)

🪛 zizmor (1.30.1)

.github/workflows/electron-build.yml

[warning] 1-144: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

[warning] 12-124: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🔇 Additional comments: 14

go.mod: 1

3-4: LGTM!

AGENTS.md: 1

9-9: LGTM!

CLAUDE.md: 1

9-9: LGTM!

README.en.md: 1

294-294: LGTM!

README.fr.md: 1

294-294: LGTM!

README.ja.md: 1

294-294: LGTM!

README.md: 1

296-296: LGTM!

README.zh_CN.md: 1

296-296: LGTM!

README.zh_TW.md: 1

296-296: LGTM!

electron/README.md: 1

40-40: LGTM!

.github/workflows/ci.yml: 1

47-49: LGTM!

.github/workflows/electron-build.yml: 1

42-42: LGTM!

Also applies to: 66-66

.github/workflows/release.yml: 1

44-44: LGTM!

Also applies to: 49-49, 55-55, 99-99, 104-104, 150-150, 155-155

Dockerfile: 1

16-16: 🩺 Stability & Availability

No change is needed for the pinned Go image.

The golang:1.26.10-alpine tag resolves to manifest digest sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca. Both Dockerfiles use this matching pin, so the claimed build failure is not present.

📝 Summary

Summary by CodeRabbit

• Security

  • Updated the required Go toolchain to 1.26.10, including the certificate-validation fix for CVE-2026-111943.
  • Existing backend binaries must be rebuilt and replaced to receive the security update; installing Go or restarting alone is insufficient.

• Documentation

  • Updated deployment and Electron packaging guidance across supported languages.

• Builds

  • CI, Docker, and release builds now consistently use the configured Go version and report embedded build metadata.

The Go module and build environments now use Go 1.26.10. CI, release, and Docker build steps report Go version or binary metadata. Deployment and development guidance describes the version baseline and the need to rebuild and replace backend binaries.

Changes: Go build baseline

Layer / File(s)	Summary
Version baseline and rebuild guidance go.mod, AGENTS.md, CLAUDE.md, README*.md, electron/README.md	The module and backend guidance specify Go 1.26.10. Deployment notes describe the stated certificate-verification fix and the need to rebuild and replace backend binaries.
CI, release, and Docker build alignment .github/workflows/ci.yml, .github/workflows/electron-build.yml, .github/workflows/release.yml, Dockerfile, Dockerfile.dev	Electron and release workflows read the Go version from go.mod. Docker builder images use Go 1.26.10. Build steps report Go version or binary metadata.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b2745

This change moves the Go build baseline to 1.26.10 and adds build-metadata reporting to CI, release and Docker builds. It also updates the deployment guidance. No concrete merge-blocking risk was found. The pinned Go builder image was confirmed to exist in the registry.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly summarizes the main change: standardizing builds on Go 1.26.10 to address CVE-2026-111943.
Description check		The description directly explains the Go toolchain update, affected build workflows and documentation, security rationale, validation results, and deployment limitations.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (15 skipped: 15 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.}

_{Comment @coderabbitai help to get the list of available commands.}

[CSCITech]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[CSCITech]

已处理本轮 Title check 和 Description check：标题明确 Go 1.26.10 / CVE-2026-111943，描述保留仓库模板并补充变更缘由、15 文件范围、官方 Issue、验证结果和未验边界；人工确认项留给维护者勾选。

代码 HEAD 仍为 b2745bbaa9113a11dbe55c03eb4faf0ee213195e。当前 head 的后端/前端 CI 和 PR Check 均通过；本地同树验证为 59 个有测试包通过、36 个无测试包，vet/JSON policy 与 Windows/Linux-amd64 CGO=0 构建通过。

沿用维护者已发出的全量复审请求，不重复触发相同 HEAD 的 full review。现有工具输出中的 shell 引用、容器健康/运行身份及 Electron 默认权限提示已逐项与 base 核对，属于既有维护建议，本 PR 不扩大为运行契约或权限配置改造，也未将它们标为已修复。Docker 实际构建、原生 CGO 发行与生产升级仍未验收。