fix: pin CNPG postgres to 18.4 (PG 18.6 segfaults the 0.113.0 DocumentDB extension; unblock E2E) + govulncheck

.github/workflows/test-unit-coverage.yml

@@ -14,7 +14,7 @@ permissions:
   pull-requests: write
 
 env:
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
 
 jobs:
   coverage:
@@ -41,12 +41,13 @@ jobs:
 
       - name: Run unit tests with coverage
         run: |
+          mapfile -t pkgs < <(go list ./... | grep -v /test/e2e)
           go test -coverprofile=coverage.out -covermode=atomic \
             -coverpkg=./... \
-            $(go list ./... | grep -v /test/e2e)
-          
-          echo "## Coverage Summary" >> $GITHUB_STEP_SUMMARY
-          go tool cover -func=coverage.out | tail -1 >> $GITHUB_STEP_SUMMARY
+            "${pkgs[@]}"
+
+          echo "## Coverage Summary" >> "$GITHUB_STEP_SUMMARY"
+          go tool cover -func=coverage.out | tail -1 >> "$GITHUB_STEP_SUMMARY"
 
       - name: Check diff coverage (newly added lines must have >= 90% coverage)
         run: |
@@ -60,14 +61,14 @@ jobs:
           git diff -U0 --no-color --relative origin/${{ github.base_ref }} -- '*.go' ':!**/zz_generated.*.go' > patch.diff
 
           # Run patch coverage analysis with JSON output
-          RESULT=$($(go env GOPATH)/bin/go-patch-cover -o json coverage.out patch.diff)
+          RESULT=$("$(go env GOPATH)"/bin/go-patch-cover -o json coverage.out patch.diff)
           echo "$RESULT" | jq .
 
           # Extract patch coverage percentage
           PATCH_COV=$(echo "$RESULT" | jq -r '.patch_coverage')
           PATCH_STMTS=$(echo "$RESULT" | jq -r '.patch_num_stmt')
           echo "Patch coverage: ${PATCH_COV}% (${PATCH_STMTS} changed statements)"
-          echo "## Diff Coverage: ${PATCH_COV}%" >> $GITHUB_STEP_SUMMARY
+          echo "## Diff Coverage: ${PATCH_COV}%" >> "$GITHUB_STEP_SUMMARY"
 
           # Enforce threshold (skip if no changed statements)
           THRESHOLD=90

.github/workflows/test-unit.yml

@@ -20,7 +20,7 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
 
 jobs:
   unit-test:
@@ -48,14 +48,14 @@ jobs:
 
       - name: Run unit tests
         run: |
-          go test -v -race -timeout 10m \
-            $(go list ./... | grep -v /test/e2e)
+          mapfile -t pkgs < <(go list ./... | grep -v /test/e2e)
+          go test -v -race -timeout 10m "${pkgs[@]}"
 
       - name: Test Summary
         if: always()
         run: |
-          echo "## Unit Test Results" >> $GITHUB_STEP_SUMMARY
-          echo "✅ Unit tests completed" >> $GITHUB_STEP_SUMMARY
+          echo "## Unit Test Results" >> "$GITHUB_STEP_SUMMARY"
+          echo "✅ Unit tests completed" >> "$GITHUB_STEP_SUMMARY"
 
   helm-chart-tests:
     name: Helm Chart Unit Tests
@@ -81,5 +81,5 @@ jobs:
       - name: Test Summary
         if: always()
         run: |
-          echo "## Helm Chart Test Results" >> $GITHUB_STEP_SUMMARY
-          echo "✅ Helm chart unit tests completed" >> $GITHUB_STEP_SUMMARY
+          echo "## Helm Chart Test Results" >> "$GITHUB_STEP_SUMMARY"
+          echo "✅ Helm chart unit tests completed" >> "$GITHUB_STEP_SUMMARY"

documentdb-kubectl-plugin/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/documentdb-kubectl-plugin
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/documentdb/documentdb-operator v0.0.0

operator/cnpg-plugins/sidecar-injector/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/cnpg-i-sidecar-injector
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/cloudnative-pg/api v1.25.1

operator/documentdb-helm-chart/crds/documentdb.io_dbs.yaml

@@ -1217,13 +1217,20 @@ spec:
                       Gateway sidecar.
                     type: string
                   postgres:
-                    default: ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie
+                    default: ghcr.io/cloudnative-pg/postgresql:18.4-minimal-trixie
                     description: |-
                       Postgres is the container image for the PostgreSQL server.
                       Must be an upstream CNPG-compatible PostgreSQL image (the operator
                       adds the DocumentDB extension via an ImageVolume mount), and must
                       use trixie (Debian 13) base to match the extension's GLIBC
                       requirements.
+
+                      Pinned to the 18.4 minor tag instead of the floating
+                      "18-minimal-trixie" tag, which rolled 18.4 -> 18.6 on 2026-08-13 and
+                      crashed the DocumentDB 0.113.0 extension on insert. Staying on 18.4
+                      avoids that regression while still receiving CNPG's Debian/PGDG
+                      security rebuilds; revert to the floating "18-minimal-trixie" tag once
+                      a DocumentDB release carrying the PG 18.6 fix ships.
                     type: string
                 type: object
               imagePullSecrets:

operator/src/api/preview/documentdb_types.go

@@ -167,7 +167,14 @@ type ImageSpec struct {
 	// adds the DocumentDB extension via an ImageVolume mount), and must
 	// use trixie (Debian 13) base to match the extension's GLIBC
 	// requirements.
-	// +kubebuilder:default="ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie"
+	//
+	// Pinned to the 18.4 minor tag instead of the floating
+	// "18-minimal-trixie" tag, which rolled 18.4 -> 18.6 on 2026-08-13 and
+	// crashed the DocumentDB 0.113.0 extension on insert. Staying on 18.4
+	// avoids that regression while still receiving CNPG's Debian/PGDG
+	// security rebuilds; revert to the floating "18-minimal-trixie" tag once
+	// a DocumentDB release carrying the PG 18.6 fix ships.
+	// +kubebuilder:default="ghcr.io/cloudnative-pg/postgresql:18.4-minimal-trixie"
 	// +optional
 	Postgres string `json:"postgres,omitempty"`
 }

operator/src/config/crd/bases/documentdb.io_dbs.yaml

@@ -1217,13 +1217,20 @@ spec:
                       Gateway sidecar.
                     type: string
                   postgres:
-                    default: ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie
+                    default: ghcr.io/cloudnative-pg/postgresql:18.4-minimal-trixie
                     description: |-
                       Postgres is the container image for the PostgreSQL server.
                       Must be an upstream CNPG-compatible PostgreSQL image (the operator
                       adds the DocumentDB extension via an ImageVolume mount), and must
                       use trixie (Debian 13) base to match the extension's GLIBC
                       requirements.
+
+                      Pinned to the 18.4 minor tag instead of the floating
+                      "18-minimal-trixie" tag, which rolled 18.4 -> 18.6 on 2026-08-13 and
+                      crashed the DocumentDB 0.113.0 extension on insert. Staying on 18.4
+                      avoids that regression while still receiving CNPG's Debian/PGDG
+                      security rebuilds; revert to the floating "18-minimal-trixie" tag once
+                      a DocumentDB release carrying the PG 18.6 fix ships.
                     type: string
                 type: object
               imagePullSecrets:

operator/src/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator
 
-go 1.26.5
+go 1.26.6
 
 godebug default=go1.23
 

test/e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/test/e2e
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/cloudnative-pg/cloudnative-pg v1.29.2

test/longhaul/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/test/longhaul
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/documentdb/documentdb-operator v0.0.0-00010101000000-000000000000

test/shared/go.mod

@@ -1,6 +1,6 @@
 module github.com/documentdb/documentdb-operator/test/shared
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/cloudnative-pg/cloudnative-pg v1.29.2