From 1c57d59f757c29ba7cb6c218769e680244933f2b Mon Sep 17 00:00:00 2001 From: Alexandre Bergere Date: Mon, 12 Oct 2026 00:01:27 +0200 Subject: [PATCH] ci: scan and release on Go 1.26, the oldest release still patched Go 1.25 left support when 1.27 shipped. Its final patch, 1.25.14, carries nine standard-library advisories (GO-2026-6603 to GO-2026-6617, in net/http, mime/multipart and crypto/tls) fixed in 1.26.9 and later only. The vulnerability scan fails on it whatever the change, and the release job built the binary with it, so a release would ship those advisories to every user. The lint job, which runs the scan, and the release job now set up the newest 1.26 patch, with check-latest so setup-go does not settle for an older one the runner caches. Build and test stay on 1.25.x, the version go.mod declares, so the language floor is still proven. Signed-off-by: Alexandre Bergere Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 17 +++++++++++------ .github/workflows/release.yml | 16 ++++++++++------ 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 03fd0c3..6efcb6a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,15 +18,20 @@ jobs: - name: Checkout code uses: actions/checkout@v5 - # 1.25.x, not go-version-file: go.mod. setup-go reads the go directive as - # an exact patch, which would pin every released binary to the stdlib as - # it shipped in that patch, CVEs included. This tracks the newest patch of - # the minor version go.mod declares, which is what a shipped binary needs; - # go.mod stays the language-version contract. + # 1.26.x here and in the release job, while build and test stay on the + # 1.25.x go.mod declares. setup-go reads the go directive as an exact + # patch, which would pin every released binary to the stdlib as it + # shipped in that patch, CVEs included, so the jobs name a minor version + # and take its newest patch -- check-latest, or setup-go settles for the + # newest one the runner caches. The scan goes one minor further because + # 1.25 left support when 1.27 shipped: its stdlib advisories are fixed in + # 1.26 and later only. go.mod stays the language-version contract, and + # the build and test jobs keep proving that floor. - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.25.x" + go-version: "1.26.x" + check-latest: true cache-dependency-path: go.sum - name: golangci-lint diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ee25174..dd52539 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,15 +17,19 @@ jobs: with: fetch-depth: 0 - # 1.25.x, not go-version-file: go.mod. setup-go reads the go directive as - # an exact patch, which would pin every released binary to the stdlib as - # it shipped in that patch, CVEs included. This tracks the newest patch of - # the minor version go.mod declares, which is what a shipped binary needs; - # go.mod stays the language-version contract. + # 1.26.x, the oldest Go still patched: a released binary carries the + # stdlib it was built with, and 1.25 left support when 1.27 shipped, so + # its advisories are fixed in 1.26 and later only. setup-go reads the go + # directive as an exact patch, which would pin every released binary to + # the stdlib as it shipped in that patch, CVEs included, so this names a + # minor version and takes its newest patch -- check-latest, or setup-go + # settles for the newest one the runner caches. go.mod stays the + # language-version contract. - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.25.x" + go-version: "1.26.x" + check-latest: true cache-dependency-path: go.sum - name: Run GoReleaser