Loading
[19.0] Bump BUILDER_IMAGE_REVISION to 5.60.6
What does this MR do and why?
Bumps BUILDER_IMAGE_REVISION to 5.60.6 on 19-0-stable. Builder 5.60.6 moves the Go toolchain to 1.26.10 (the Go fix for the eMudhra/emSign CA compromise, CVE-2026-111943) and forces GOFIPS140=off so FIPS (boringcrypto) builds keep working. Pairs with the cacerts 2026.10.20 backport !9978 (merged).
Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/work_items/10160+s
Related https://gitlab.com/gitlab-org/release/tasks/-/work_items/28133+s
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
- This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
- The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
- This MR has a severity label assigned (if applicable).
Note to the merge request author and maintainer
If you have questions about the patch release process, please:
- Refer to the patch release runbook for engineers and maintainers for guidance.
- Ask questions on the
#releasesSlack channel (internal only).
Edited by Robert Marshall