Repository navigation
chore(deps): move to go 1.26.9, which closes nine standard library holes - #64
Merged
Merged
Conversation
govulncheck has been failing on every open pull request, and not because of what any of them change: the toolchain pinned in go.mod is affected by nine vulnerabilities our own code reaches — seven in net/http, one in net/textproto and one in crypto/tls — all fixed in go1.26.9. A syslog receiver that listens on TCP and TLS is exactly the kind of program those reach. The version lives in go.mod alone and CI reads it from there, so this one line moves the build, the tests and the release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
govulncheckhas been failing on every open pull request, and not because of what any of them change:These are the ones
govulnchecksays our code actually reaches, not merely imports — and a syslog receiver that listens on TCP and TLS is exactly the kind of program that reaches them.The toolchain version lives in
go.modalone (CI usesgo-version-file: go.mod, one source of truth), so this single line moves the build, the tests and the release together.Verified locally on the new toolchain:
go vetandgo test -race ./...across all ten packages.The seven Dependabot pull requests that were failing this check should go green once they sit on top of this.