Repository navigation
fix(ci): update Go toolchain to 1.26.9 for security fixes - #143
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Main Validation failed on Linux, macOS, and Windows because
govulncheckreported nine reachable standard-library vulnerabilities in the pinned Go 1.26.6 toolchain. Update the toolchain to Go 1.26.9, the patched version reported by the scanner. All validation and release jobs already read this pin fromgo.mod.User-visible impact
CI and release builds use the patched Go 1.26.9 toolchain. The module's Go language requirement remains 1.26.0.
Safety and passthrough boundary
This changes only the build toolchain. Native execution, exit codes, diagnostics, raw mode, and fallback behavior are unchanged. The vulnerability gate remains enforced.
Validation
cmdshape go tool govulncheck ./...: exit 3 with nine standard-library findings on Go 1.26.6.cmdshape go tool govulncheck ./...passes withNo vulnerabilities found.cmdshape go test -count=1 -race ./...cmdshape go mod tidy -diffcmdshape go vet ./...cmdshape go tool staticcheck ./...cmdshape go tool golangci-lint run ./...cmdshape go tool ineffassign ./...cmdshape go tool gocyclo -over 15 .cmdshape git diff --checkThe full validation script was not run locally because no Go source files changed, per AGENTS.md. PR Validation passed all 112 jobs on commit
071c29bd88db9fbc4dd2eb8c2dced8f3841b0a1f, including the full validation helper and installed binary smoke tests on Linux, macOS, and Windows, fixture correctness, benchmarks, and SonarQube.Documentation, fixtures, and generated facts
No updates required; the patch is a single toolchain pin in
go.mod.