gchahcg · Oct 11, 2026
diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
@@ -37,7 +37,7 @@ jobs:
 
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
 
       - name: Run live-provider canaries
         env:

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
         run: make go-version-check
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -118,7 +118,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -147,7 +147,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - run: go test -coverprofile=coverage.out -covermode=atomic ./cmd/... ./internal/... ./tools/...
       - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
@@ -211,7 +211,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - name: Run API race shard
         if: matrix.scope == 'api'
@@ -272,7 +272,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       # Coverage runs on main and development only. On a v* tag this job gates
       # the image and goreleaser, so it runs the same suites without coverage:
@@ -353,7 +353,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - name: Run API race shard
         if: matrix.scope == 'api'
@@ -558,7 +558,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -680,7 +680,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - name: Run ABS contract suite
         env:
@@ -709,7 +709,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
       - name: Wait for ArgoCD dev to sync
         env:

diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
 
       - name: Locate Go fuzz corpus cache

diff --git a/.github/workflows/ping-drift.yml b/.github/workflows/ping-drift.yml
@@ -42,7 +42,7 @@ jobs:
 
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
 
       # "the newest commit that would have produced an image" is git's

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -308,7 +308,7 @@ jobs:
 
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.26.9"
           cache: true
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

diff --git a/Dockerfile b/Dockerfile
@@ -16,7 +16,7 @@ COPY internal/textutil/testdata/ /app/internal/textutil/testdata/
 RUN npm run build
 
 # Stage 2: Build Go binary (native on BUILDPLATFORM, cross-compile to TARGETOS/TARGETARCH)
-FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/changelog.d/go-toolchain-1.26.9-cve.md b/changelog.d/go-toolchain-1.26.9-cve.md
@@ -0,0 +1,2 @@
+### Security
+- **Bumped the Go toolchain to 1.26.9**, fixing [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617), an HTTP/2 server crash from an HPACK encoder race in `net/http`. Every build target (`go.mod`, the three Dockerfiles, every CI workflow) moves together, the same discipline #2956 established for the release binaries and the container image.
diff --git a/cmd/discord-stats/Dockerfile b/cmd/discord-stats/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder
+FROM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/cmd/telemetry-server/Dockerfile b/cmd/telemetry-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder
+FROM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -33,7 +33,7 @@ to sync from until they are relinked.
 | Layer | Stack | Notes |
 |-------|-------|-------|
 | **HTTP router** | [chi](https://github.com/go-chi/chi) v5 | Sub-routers per resource, middleware-driven auth/CSRF/rate-limit. |
-| **Backend language** | Go 1.26 (built with `golang:1.26.8-alpine`, the toolchain pinned in `go.mod`) | Standard library HTTP server, structured logging via `slog`. |
+| **Backend language** | Go 1.26 (built with `golang:1.26.9-alpine`, the toolchain pinned in `go.mod`) | Standard library HTTP server, structured logging via `slog`. |
 | **Database** | SQLite, WAL mode | [`modernc.org/sqlite`](https://pkg.go.dev/modernc.org/sqlite) — pure Go, no CGO. Single `bindery.db` file. Connection pragmas (`foreign_keys`, `busy_timeout`, `synchronous`, `temp_store`, `cache_size`) are carried in the DSN so the driver reapplies them to every connection it opens; see [Database durability](DEPLOYMENT.md#database-durability). |
 | **Schema migrations** | Embedded SQL files in `internal/db/migrations/` | Linearly-numbered, additive-only, applied at startup. |
 | **Frontend** | React 19 + TypeScript + Tailwind CSS 4 | Built with [Vite](https://vite.dev), output baked into the binary via `go:embed`. |

diff --git a/go.mod b/go.mod
@@ -2,7 +2,7 @@ module github.com/vavallee/bindery
 
 go 1.26.0
 
-toolchain go1.26.8
+toolchain go1.26.9
 
 require (
 	github.com/coreos/go-oidc/v3 v3.21.0
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		### Security
		- Bumped the Go toolchain to 1.26.9, fixing [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617), an HTTP/2 server crash from an HPACK encoder race in `net/http`. Every build target (`go.mod`, the three Dockerfiles, every CI workflow) moves together, the same discipline #2956 established for the release binaries and the container image.