From a7966fcbf082e9f9de19814a891240669e13a8be Mon Sep 17 00:00:00 2001 From: prode Date: Sun, 18 Oct 2026 02:04:39 -0300 Subject: [PATCH] fix(ci): build and release on Go 1.26.9, the first toolchain with the net/http and crypto/tls fixes govulncheck fails every PR on GO-2026-6603..6617 (net/http, net/textproto, crypto/tls) reachable from scc's call graph. The 1.25 line is out of support and has no backport; 1.26.9 is the first fixed release. go.mod's go 1.25.0 directive is unchanged, so GOTOOLCHAIN=auto still installs on older setups. --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/release.yml | 2 +- docs/stack.md | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5e70736..29a18c5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,11 +35,11 @@ jobs: # Build/test with a current, patched toolchain. Keep this pin AHEAD of # go.mod's directive and do NOT switch to go-version-file: go.mod — # install-compat with older toolchains rides on GOTOOLCHAIN=auto. - # Pinned to .13 for the GO-2026-6088 encoding/xml fix, which the pom - # reader reaches through xml.Unmarshal (.12 was the GO-2026-5856 - # crypto/tls fix). The float '1.25' lags on hosted runners; float back - # once runners catch up. - go-version: '1.25.13' + # Pinned to 1.26.9: 1.25 is out of support, and GO-2026-6603..6617 + # (net/http, net/textproto, crypto/tls) are fixed only from 1.26.9. + # Earlier pins: 1.25.13 for GO-2026-6088 encoding/xml, 1.25.12 for + # GO-2026-5856 crypto/tls. + go-version: '1.26.9' cache: true - name: go vet @@ -74,7 +74,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25.13' # GO-2026-6088 encoding/xml fix; see the test job's note + go-version: '1.26.9' # see the test job's note cache: true - name: gofmt diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fcfd7d1..466c493 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -96,7 +96,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25.13' # see ci.yml's note before changing + go-version: '1.26.9' # see ci.yml's note before changing cache: true - name: Build & package diff --git a/docs/stack.md b/docs/stack.md index 2fb36cd..05e3041 100644 --- a/docs/stack.md +++ b/docs/stack.md @@ -10,7 +10,7 @@ nobody recorded a reason, this file says so rather than inventing one. ## The module - **Go 1.25** — `go.mod` declares `go 1.25.0`; CI pins the toolchain ahead of it at - `1.25.13`, deliberately, so `GOTOOLCHAIN=auto` still installs for older setups. + `1.26.9`, deliberately, so `GOTOOLCHAIN=auto` still installs for older setups. Chosen for what the product is: one static binary, cross-compiled to six targets, that an agent or a CI job can run with nothing installed underneath it. - **The standard library, and nothing else** — `go.mod` has no `require` block at