From d2f009e73da90738208f9e2fe78ae88e37de4ffc Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 14 Aug 2026 01:46:44 +0200 Subject: [PATCH] fix(ci): bump pinned Go toolchain to 1.26.6 for stdlib CVE fixes govulncheck started failing repo-wide on 7 Go standard library advisories, all reported as present in go1.26.5 and fixed in go1.26.6: GO-2026-6218 (net/url), GO-2026-6091 (html/template), GO-2026-6090 (crypto/tls), GO-2026-6089 (net/http), GO-2026-6088 (encoding/xml), GO-2026-5972 (encoding/asn1) and GO-2026-5026 (net/http). The failure is time-based rather than change-based: govulncheck fetches the vulnerability database at run time, so the same commit that passed before these advisories were published now fails. With CI Success gated on the Security Scanning job, no PR could satisfy the merge gate. Bump the pinned toolchain in both workflows that pin it explicitly. pre-commit.yml carried the same 1.26.5 pin in a double-quoted form, so it needs the same bump to keep both workflows on one toolchain. The go directives in the six go.mod files are deliberately left at 1.26.5 / 1.25. The directive is a minimum, and setup-go installing 1.26.6 supplies the 1.26.6 standard library regardless. Verified locally against the CI-pinned tool versions on a real go1.26.6 toolchain: govulncheck v1.1.4 reproduces all 7 advisories on 1.26.5 (exit 3) and reports every one of the six modules clean on 1.26.6 (exit 0). golangci-lint v2.10.1, go vet, gosec v2.28.0 and go build all pass on the newer toolchain. Closes #1829 --- .github/workflows/ci.yml | 4 ++-- .github/workflows/pre-commit.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8c889f977..e36f247c4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ # Required GitHub Secrets: None (all checks run without cloud credentials) # # Required GitHub Variables: -# - GO_VERSION: Go version to use (default: 1.26.5) +# - GO_VERSION: Go version to use (default: 1.26.6) # # Triggered by: # - Pull requests to main/develop @@ -23,7 +23,7 @@ on: workflow_dispatch: env: - GO_VERSION: '1.26.5' + GO_VERSION: '1.26.6' DOCKER_BUILDKIT: 1 COMPOSE_DOCKER_CLI_BUILD: 1 diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 4fbf6e347..9a64f2490 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -32,7 +32,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.26.5" + go-version: "1.26.6" - name: Set up Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0