Azure · JeffreyCA · Jun 12, 2026 · Jun 12, 2026 · Jun 12, 2026
@@ -3,7 +3,7 @@
     "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
     "features": {
         "ghcr.io/devcontainers/features/go:1": {
-            "version": "1.26.1"
+            "version": "1.26.4"
         },
         "ghcr.io/devcontainers/features/docker-in-docker:2.11.0": {
             "version": "latest",

@@ -83,7 +83,7 @@ jobs:
 
           echo ""
           if [ "$ERRORS" -gt 0 ]; then
-            echo "::error::$ERRORS Go version mismatch(es) found. Run 'pwsh eng/scripts/Update-GoVersion.ps1 -NewVersion $EXPECTED' to fix."
+            echo "::error::$ERRORS Go version mismatch(es) found. Run 'cd cli/azd && mage updateGoVersion $EXPECTED' to fix."
             exit 1
           fi
           echo "All Go versions are consistent ($EXPECTED)."
@@ -79,6 +79,7 @@ Additional mage targets:
 
 - `mage record` — re-record functional test cassettes against a live Azure subscription. Accepts an optional `-filter=TestName` flag to re-record specific tests. Typically only core maintainers need to run this; external contributors can rely on playback mode (the default) which requires no Azure access. Requires `azd auth login` and a configured test subscription (see `docs/recording-functional-tests-guide.md`).
 - `mage coverage:pr` — preview the CI PR coverage gate locally before pushing. Resolves PR-touched `.go` files via `git merge-base origin/main HEAD` for the per-package summary, runs the diff against the latest `main` baseline, and fails (exit 2) on **either** breach type: any PR-touched package drops more than 0.5 pp, or overall coverage falls below 69% (defaults match CI; override via `COVERAGE_MAX_PACKAGE_DECREASE`, `COVERAGE_MIN_OVERALL`). See `docs/code-coverage-guide.md` for details.
+- `mage updateGoVersion <version>` — bump the pinned Go toolchain version everywhere it is referenced (every `cli/azd` `go.mod`, the ADO `setup-go` template, Dockerfiles, and the devcontainer Go feature). `cli/azd/go.mod` is the source of truth enforced by the `validate-go-version` workflow. This is the single source of truth for the sync logic. Example: `mage updateGoVersion 1.26.4`.
 
 ```bash
 gofmt -s -w .

@@ -1,6 +1,6 @@
 module azureaiagent
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0

@@ -1,6 +1,6 @@
 module azure.ai.connections
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0

@@ -1,6 +1,6 @@
 module azure.ai.finetune
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0

@@ -1,6 +1,6 @@
 module azureaiinspector
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/azure/azure-dev/cli/azd v1.24.3

@@ -1,6 +1,6 @@
 module azure.ai.models
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0

@@ -1,6 +1,6 @@
 module azure.ai.projects
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0

@@ -1,6 +1,6 @@
 module azure.ai.routines
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0

@@ -1,6 +1,6 @@
 module azureaiskills
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0

@@ -1,6 +1,6 @@
 module azure.ai.toolboxes
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0

@@ -1,6 +1,6 @@
 module azure.ai.training
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0

@@ -1,6 +1,6 @@
 module azureappservice
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0

@@ -1,6 +1,6 @@
 module azurecodingagent
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0

@@ -1,6 +1,6 @@
 module concurx
 
-go 1.26.1
+go 1.26.4
 
 require (
 	github.com/azure/azure-dev/cli/azd v1.23.13

@@ -1,6 +1,6 @@
 module github.com/azure/azure-dev/cli/azd
 
-go 1.26.1
+go 1.26.4
 
 require (
 	dario.cat/mergo v1.0.2
@@ -82,9 +82,9 @@ require (
 	go.uber.org/atomic v1.11.0
 	go.uber.org/multierr v1.11.0
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.42.0
-	golang.org/x/term v0.41.0
+	golang.org/x/sync v0.21.0
+	golang.org/x/sys v0.46.0
+	golang.org/x/term v0.44.0
 	golang.org/x/time v0.9.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9
 	google.golang.org/grpc v1.80.0
@@ -146,9 +146,9 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
 	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
-	golang.org/x/crypto v0.49.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
-	golang.org/x/net v0.52.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
 )
@@ -351,22 +351,22 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
 golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -378,18 +378,18 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
 golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

@@ -448,6 +448,134 @@ func Record(filter *string) error {
 	})
 }
 
+// UpdateGoVersion updates the pinned Go toolchain version across the repository
+// so that every cli/azd go.mod (core, extensions, and testdata samples), the
+// ADO setup-go pipeline template, Dockerfiles, and the devcontainer Go feature
+// stay in sync. cli/azd/go.mod is the source of truth enforced by the
+// validate-go-version workflow.
+//
+// This is the single source of truth for the version-sync logic.
+//
+// Usage: mage updateGoVersion 1.26.4
+func UpdateGoVersion(version string) error {
+	version = strings.TrimSpace(version)
+	if version == "" {
+		return errors.New("a Go version is required, e.g. 'mage updateGoVersion 1.26.4'")
+	}
+
+	// Require a bare X.Y.Z version to avoid corrupting go.mod, Dockerfiles, and
+	// templates with typos like "1.26" or "go1.26.4".
+	if !regexp.MustCompile(`^\d+\.\d+\.\d+$`).MatchString(version) {
+		return fmt.Errorf(
+			"invalid Go version %q: expected a X.Y.Z version such as 1.26.4 (no 'go' prefix)", version)
+	}
+
+	repoRoot, err := findRepoRoot()
+	if err != nil {
+		return err
+	}
+	azdDir := filepath.Join(repoRoot, "cli", "azd")
+
+	var updated, skipped []string
+
+	// replaceInFile rewrites a file in place only when the substitution changes
+	// it, preserving the original file mode and tracking updated/skipped state.
+	// Files that don't contain the targeted pattern at all are ignored so the
+	// report only lists relevant files.
+	replaceInFile := func(path string, re *regexp.Regexp, replacement string) error {
+		info, err := os.Stat(path)
+		if err != nil {
+			return err
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		if !re.Match(data) {
+			return nil
+		}
+
+		rel, relErr := filepath.Rel(repoRoot, path)
+		if relErr != nil {
+			rel = path
+		}
+
+		newData := re.ReplaceAll(data, []byte(replacement))
+		if bytes.Equal(newData, data) {
+			skipped = append(skipped, rel)
+			return nil
+		}
+		if err := os.WriteFile(path, newData, info.Mode().Perm()); err != nil {
+			return err
+		}
+		updated = append(updated, rel)
+		return nil
+	}
+
+	// Update go.mod files (including testdata samples) and Dockerfiles.
+	goDirective := regexp.MustCompile(`(?m)^go\s+\S+`)
+	dockerImage := regexp.MustCompile(`golang:\d+[\d.]*`)
+	walkErr := filepath.WalkDir(azdDir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+		switch d.Name() {
+		case "go.mod":
+			return replaceInFile(path, goDirective, "go "+version)
+		case "Dockerfile":
+			return replaceInFile(path, dockerImage, "golang:"+version)
+		}
+		return nil
+	})
+	if walkErr != nil {
+		return walkErr
+	}
+
+	// Update the ADO pipeline template that pins the Go toolchain version.
+	adoSetupGo := filepath.Join(repoRoot, "eng", "pipelines", "templates", "steps", "setup-go.yml")
+	if _, err := os.Stat(adoSetupGo); err == nil {
+		adoVersion := regexp.MustCompile(`(?m)^(\s+GoVersion:\s+)\S+`)
+		if err := replaceInFile(adoSetupGo, adoVersion, "${1}"+version); err != nil {
+			return err
+		}
+	}
+
+	// Update the devcontainer Go feature version.
+	devcontainer := filepath.Join(repoRoot, ".devcontainer", "devcontainer.json")
+	if _, err := os.Stat(devcontainer); err == nil {
+		dcVersion := regexp.MustCompile(
+			`("ghcr\.io/devcontainers/features/go:\d+":\s*\{\s*"version":\s*")[\d.]+(")`)
+		if err := replaceInFile(devcontainer, dcVersion, "${1}"+version+"${2}"); err != nil {
+			return err
+		}
+	}
+
+	slices.Sort(updated)
+	slices.Sort(skipped)
+
+	fmt.Println()
+	if len(updated) > 0 {
+		fmt.Printf("Updated %d file(s) to Go %s:\n", len(updated), version)
+		for _, f := range updated {
+			fmt.Printf("  %s\n", f)
+		}
+	} else {
+		fmt.Println("No files needed updating.")
+	}
+	if len(skipped) > 0 {
+		fmt.Printf("\nAlready at Go %s (%d file(s)):\n", version, len(skipped))
+		for _, f := range skipped {
+			fmt.Printf("  %s\n", f)
+		}
+	}
+	fmt.Println("\nDone. GitHub Actions workflows read the version from cli/azd/go.mod automatically.")
+	fmt.Println("Run 'git diff' to review changes before committing.")
+	return nil
+}
+
 // mageInit sets up the standard mage environment (GOWORK=off, GOTOOLCHAIN pin)
 // and returns the cli/azd directory path. Callers must defer the returned
 // cleanup function to restore environment variables.

@@ -1,4 +1,4 @@
-FROM golang:1.26.1-alpine AS build
+FROM golang:1.26.4-alpine AS build
 WORKDIR /app
 COPY . .
 RUN go build -o /job .

@@ -1,3 +1,3 @@
 module containerappjob
 
-go 1.26.1
+go 1.26.4
@@ -1,5 +1,5 @@
 parameters:
-  GoVersion: 1.26.1
+  GoVersion: 1.26.4
   Condition: succeeded()
 
 steps: