Repository navigation
ci: scan and release on Go 1.26, the oldest release still patched - #6
Merged
Merged
Conversation
Go 1.25 left support when 1.27 shipped. Its final patch, 1.25.14, carries nine standard-library advisories (GO-2026-6603 to GO-2026-6617, in net/http, mime/multipart and crypto/tls) fixed in 1.26.9 and later only. The vulnerability scan fails on it whatever the change, and the release job built the binary with it, so a release would ship those advisories to every user. The lint job, which runs the scan, and the release job now set up the newest 1.26 patch, with check-latest so setup-go does not settle for an older one the runner caches. Build and test stay on 1.25.x, the version go.mod declares, so the language floor is still proven. Signed-off-by: Alexandre Bergere <[email protected]> Co-Authored-By: Claude Opus 5.5 <[email protected]>
fuzcap
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR change?
The
lintjob, which runs the vulnerability scan, and thegoreleaserjob set up Go1.26.xwithcheck-latest: true, instead of1.25.x. Thebuildandtestjobs stay on1.25.x, andgo.modis unchanged.Why?
Go 1.25 left support when 1.27 shipped. Its final patch, 1.25.14, carries nine standard-library advisories that are fixed in 1.26.9 and later only: GO-2026-6603 to GO-2026-6617, in
net/http,mime/multipartandcrypto/tls.main's last green run, 2026-10-08, predates the advisories).release.ymlbuilt the binary with 1.25.x, so a release would ship those advisories to every user: a binary carries the standard library it was built with.check-latest, because without it setup-go settles for the newest patch the runner already caches. That bit kaitencloud/sdk-go#6, the same change for the SDK, which got 1.26.8.Testing
govulncheckv1.1.4 locally: 9 standard-library vulnerabilities reached on Go 1.25.14, "No vulnerabilities found" on 1.26.9.go mod tidyleavesgo.mod/go.sumunchanged, and golangci-lint v2.12.2 reports 0 issues.actionlintv1.7.7 on both workflows: clean.Checklist
CONTRIBUTING.md.Signed-off-byline.🤖 Generated with Claude Code · ✅ Tested and approved by Alex (@Alexkuva), maintainer