From 1d88c5da84ade88298d8005c44d044574b51c33f Mon Sep 17 00:00:00 2001 From: Sulaiman Dauda Date: Wed, 21 Oct 2026 08:58:13 +0100 Subject: [PATCH] ci: use the newest Go 1.26 patch for the backend The range '>=1.25.12' let setup-go keep the runner's cached Go 1.26.9, which carries GO-2026-6809 in crypto/x509, so govulncheck failed every backend run. Asking for 1.26.x with check-latest fetches 1.26.10 now and each later patch as Go ships it. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2937837..e689405 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,9 +26,12 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - # 1.25.12 or newer: 1.25.11 carries GO-2026-5856, an Encrypted Client - # Hello privacy leak in crypto/tls that govulncheck finds reachable. - go-version: '>=1.25.12' + # The newest 1.26 patch, fetched rather than taken from the runner's + # cache, so a standard library fix reaches govulncheck as soon as Go + # ships it. A range like '>=1.25.12' kept the cached 1.26.9, which + # carries GO-2026-6809 (crypto/x509), fixed in 1.26.10. + go-version: '1.26.x' + check-latest: true cache-dependency-path: backend/go.sum - name: Add PostgreSQL binaries to PATH