From 3649e87adc438257f610a655a4c7bb15d5914d2e Mon Sep 17 00:00:00 2001 From: Jeppe Lillevang Salling Date: Sat, 18 Jul 2026 00:32:46 +0200 Subject: [PATCH] chore: bump Go toolchain to 1.26.5 to clear stdlib advisories Closes #77. PR #73's `agent-init upgrade` introduced a net/http path that makes govulncheck report stdlib advisories reachable from selfupdate. #77 asked for go1.26.4 to clear GO-2026-5037/5039; bumping there clears those two but govulncheck then surfaces GO-2026-5856 (crypto/tls Encrypted Client Hello privacy leak), reachable through the same HTTP path and fixed in go1.26.5. To satisfy the issue's "check.sh runs clean" acceptance criterion rather than just its literal version, this pins go1.26.5. Verified: `govulncheck ./...` reports "No vulnerabilities found"; build, vet, and the full test suite pass. CI reads the version via `go-version-file: go.mod`, so no CI/devcontainer pin changes are needed. Co-Authored-By: Claude Opus 4.8 (1M context) --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index d8734e4..e4855d0 100644 --- a/go.mod +++ b/go.mod @@ -2,4 +2,4 @@ module github.com/Lillevang/agent-init go 1.26 -toolchain go1.26.3 +toolchain go1.26.5