From c3714ef081473574a9fc58a84b607cfb63f3303a Mon Sep 17 00:00:00 2001
From: Mohammad Abdolirad <m.abdolirad@gmail.com>
Date: Mon, 3 Aug 2026 23:08:50 +0200
Subject: [PATCH] bump Go toolchain to 1.26.5

- clear reachable stdlib advisories that fail OSV CI
- pin Dockerfile tag to 1.26.5-alpine (same digest)
---
 Dockerfile | 2 +-
 go.mod     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b340d83..de02954 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.9.0@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
 
-FROM --platform=$BUILDPLATFORM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS base
+FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS base
 ENV GO111MODULE=on
 ENV CGO_ENABLED=0
 COPY --from=xx / /
diff --git a/go.mod b/go.mod
index 72b650a..b3cfbec 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module deployah.dev/deployah
 
-go 1.26.3
+go 1.26.5
 
 require (
 	dario.cat/mergo v1.0.2