[s-stumbo]

Summary

Documents CVE remediation for Chainguard Libraries for Go across the Libraries
docs that previously covered only Python, Java, and JavaScript. This mirrors the
JavaScript remediation PR (#4103) and fills the Go gaps surfaced by a
related-pages scan.

Changes:

• cve-remediation: Add Go to the ecosystem list (beta), a Go version-naming
  subsection, a Go transitive-dependency block covering replace directives, and
  the Go endpoint in the browse list.
• go/overview: Standardize the remediated suffix to the dotted -cgr.N form,
  correct the base-version example to v1.2.5-cgr.1 (it previously jumped to
  v1.2.6), and fix two typos.
• go/build-configuration: Add a Checksum database settings subsection
  covering GONOSUMDB, with warnings against GOPRIVATE and GONOSUMCHECK, and a
  Use remediated Go versions section covering the explicit -cgr.N adoption
  workflow.
• go/global-configuration: Add a Serve remediated Go versions section
  explaining that Go needs no separate remediated repository, unlike Python and
  Java.
• go/migration: Add a Step 5: Adopt remediated versions explicitly section
  covering go get and the require directive.
• faq: Add Go to the malware-hardened framing, the per-ecosystem CVE
  remediation list, and the repo-manager global-configuration links.

Notes for the reviewer

• The dotted -cgr.N form and the v1.2.5 → v1.2.5-cgr.1 example are inferred
  from the other ecosystems and from the existing Go pages. Worth an engineering
  confirm that this is the canonical Go suffix.
• The claim in go/global-configuration that Go needs no separate remediated
  repository in a repo manager follows from Go using the same /go endpoint, but
  it has not been verified against a live Artifactory go-all setup.
• Go is intentionally left out of the Browse and Scanners pages: Browse is already
  stale on JavaScript and belongs in a separate update, and scanner support for Go
  -cgr.N versions is a factual claim that needs partner confirmation.

How should this PR be tested?

Any documentation published to Chainguard Academy is reviewed carefully for
accuracy. GUI procedures, API commands, and CLI code snippets in a draft are run
and tested thoroughly — by both the author and the reviewer — to confirm they work
exactly as written. See the edu repo's README.

Steps to verify this change:

1. Build the site locally with npm ci && npm run dev (Hugo ≥ 0.164) and confirm
   the six changed pages render without shortcode or TOC errors.
2. On the CVE remediation page, confirm the intro lists Go (beta), the new
   Go version naming subsection appears under Remediated version naming, the
   Go block appears under Remediation and transitive dependencies, and the Go
   endpoint appears in the browse list.
3. On the Go build configuration page, confirm the new Checksum database
   settings and Use remediated Go versions sections render, and that the
   heading anchor #use-remediated-go-versions resolves.
4. On the Go global configuration page, confirm the Serve remediated Go
   versions section renders and its link to
   go/build-configuration#use-remediated-go-versions resolves.
5. On the Go migration page, confirm the new Step 5: Adopt remediated
   versions explicitly section renders at the end of the procedure.
6. On the FAQ, confirm the malware-hardened answer now covers Go, the
   per-ecosystem list has a Go bullet, and the repo-manager links include Go.
7. With a Go project entitled to Chainguard Libraries for Go, follow the
   replace-directive and go get snippets against a real remediated version and
   confirm go mod tidy and go mod verify succeed:

   go get example.com/module@vX.Y.Z-cgr.1
   go mod tidy
   go mod verify

---

Created in collaboration with Claude Code running Claude Opus 4.8 (1M context) on 2026-10-14.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
chainguard-docs-preview	Ready	Preview	Oct 15, 2026 1:58pm UTC

[netlify]

✅ Deploy Preview for ornate-narwhal-088216 ready!

Name	Link
🔨 Latest commit	6d9a8ea
🔍 Latest deploy log	https://app.netlify.com/projects/ornate-narwhal-088216/deploys/6ad0dbd7e423e5a0bd9b350d
😎 Deploy Preview	https://deploy-preview-4208--ornate-narwhal-088216.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.