[jordane]

Summary

• Upgrade to Go 1.26.9 and refresh dependencies to remediate the nine stdlib advisories reported by OSV Scanner.
• Select the checksum-verified toolchain from go.mod in a fail-closed MegaLinter pre-command and propagate it to linter subprocesses for CI and local runs. Vulnerability scanning remains enabled and blocking.
• Document the effective toolchain and Go-linter compatibility policy.

Local OSV Scanner, checks (including pinned Revive), race tests, and Linux/Windows builds pass. Full MegaLinter container validation awaits CI because local Docker access is denied.

Fixes linuxfoundation/lfx-self-serve-ops#509

Separate from the browser-launch validation fix in #15.

[Copilot]

🔵 Needs a closer look

Full MegaLinter container validation remains pending for the Go minor-version upgrade and toolchain propagation.

0 open findings

What changed in this PR

Updates the LFX CLI toolchain and dependencies to address reported standard-library vulnerabilities.

Changes:

• Raises the required Go version to 1.26.9 and refreshes dependencies.
• Adds fail-closed MegaLinter toolchain selection and propagation.
• Documents toolchain setup and linter compatibility requirements.

File	Description
README.md	Documents the Go requirement and MegaLinter download behavior.
go.sum	Updates dependency checksums.
go.mod	Upgrades Go and dependency versions.
AGENTS.md	Clarifies runtime and linter compatibility policy.
.mega-linter.yml	Selects and propagates the required Go toolchain before linting.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[andrest50]

This PR upgrades Go from 1.25.14 to 1.26.9 and refreshes dependencies to remediate nine stdlib advisories flagged by OSV Scanner, and adds a fail-closed MegaLinter pre-command that selects and downloads the pinned toolchain from go.mod before linters run. The approach is well thought-out: the awk-based toolchain extraction is correct, the set -eu + continue_if_failed: false combination is genuinely fail-closed, and the output_variables propagation is the right way to make GOTOOLCHAIN available to linter subprocesses. Documentation and agent guidance are updated accurately.

What's done well

• The pre-command cleanly decouples the effective Go runtime from whatever version the MegaLinter image happens to bundle, which was the root cause of needing to pin the minor version behind the image before. The approach works for both CI and local Docker runs.
• go version after setting GOTOOLCHAIN serves as an immediate verification step and will trigger toolchain download exactly once on a cold container.
• The awk extractor ($1 == "go" { print $2; exit }) correctly handles leading comment lines and stops after the first match. It won't be confused by a future toolchain directive because that directive's first field would be toolchain, not go.
• AGENTS.md correctly removes the old "stay one minor behind the image" constraint, which was a workaround for the exact problem the pre-command now solves. The replacement guidance is accurate.
• go.sum entries are consistent with every module version in go.mod.

Outside the diff

• Full MegaLinter container validation is pending (acknowledged in the PR description — local Docker access denied). The most important thing to verify on the first CI run is that GOTOOLCHAIN propagates correctly to GO_REVIVE and that the pinned Revive version builds cleanly against Go 1.26.9.

Reconciliation with existing reviews

• ➡️ github-license-compliance[bot] "BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang" on go.mod line 1 — this is the Google patent grant language that accompanies golang.org/x/oauth2 (and other golang.org/x/ packages) and was present before this PR. The bumps from v0.36.0 → v0.37.0 of oauth2 do not change the license. If the policy has not accepted this expression, it should be tracked separately; it is not introduced by this PR.
• ➡️ Copilot "full MegaLinter container validation pending" — acknowledged in the PR description; acceptable given local Docker access is denied.

Issue count

• 🔴 Blocking: 0
• 🟡 Major: 0
• 🔵 Minor: 1
• ⚪ Nit: 0
• ❔ Question: 0

Decision

Approving — no blocking or major findings. One minor note on the undocumented non-stdlib minor version bumps is included below as a PR comment.

[andrest50]

Minor — non-stdlib minor version bumps not explained in the PR description (go.mod)

Three direct dependencies take minor version increments beyond what the nine stdlib CVEs require: tidwall/gjson v1.19.0 → v1.20.0, urfave/cli/v3 v3.13.0 → v3.14.0, and golang.org/x/oauth2 v0.36.0 → v0.37.0. The PR description attributes all dependency updates to the stdlib advisories, but these packages aren't in the stdlib CVE list.

Why it matters: If these were swept up incidentally by go get -u ./... rather than being targeted security fixes, noting that — or confirming they were reviewed for breaking changes — would complete the justification and make future bisection easier if a behavior change surfaces. (Neither urfave/cli/v3 nor gjson has a known breaking change at these versions, so this is informational rather than a blocker.)

Fix: Add one sentence to the PR description: e.g. "Dependency refresh also picked up minor updates to tidwall/gjson, urfave/cli/v3, and golang.org/x/oauth2 that were identified as safe (no breaking changes in their changelogs)."

[emsearcy]

Closing in favor of #17, which supersedes this with the same Go/dependency bump plus a broader MegaLinter v10.1.0 upgrade. The GOTOOLCHAIN handling in #17 uses the simpler GOTOOLCHAIN: auto approach rather than this PR's fail-closed PRE_COMMANDS script, which is an acceptable tradeoff.