fix: build against Go 1.26.6 to clear four reachable stdlib advisories - #37
Merged
Conversation
CI's Vulnerabilities job went red on main at 70571c8 — a commit that touched only .goreleaser.yaml. The diff was not the cause. govulncheck found four standard-library advisories reachable from this binary, all fixed in go1.26.6: GO-2026-6218 quadratic complexity in net/url.resolvePath GO-2026-6090 unbounded post-handshake messages in crypto/tls GO-2026-5972 recursion depth in encoding/asn1 GO-2026-5026 ASCII-only Punycode labels in net/http's IDNA handling Three were filed on 2026-08-13 at 21:43 UTC, about nineteen hours after that branch's last green run. So the code stood still and the advisory database moved — which is the whole point of running this on every push rather than only when something changes. setup-go resolves the toolchain from the `go` directive in go.mod, and the job sets GOTOOLCHAIN=local, so CI builds against exactly that patch release. Bumping the directive to 1.26.6 is therefore both the fix and the reason the directive carries a patch version in the first place; the govulncheck step now says so, so the next person to see this fail looks at the stdlib before hunting through a diff that is not at fault. Verified locally on go1.26.6: govulncheck reports no vulnerabilities, the remaining two findings being in modules we require but do not call. Tests, lint, verify-generate, and go mod tidy are all clean. Raises the minimum build requirement to Go 1.26.6.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
The Vulnerabilities job failed on
mainat 70571c8 — the merge of #36, which changed nothing but.goreleaser.yaml. The diff wasn't the cause.govulncheckfound four standard-library advisories reachable from this binary, all fixed ingo1.26.6:GO-2026-6218net/url.resolvePathgen.NewZoneCheckRequestWithBody→url.URL.ParseGO-2026-6090crypto/tlsretryTransport.RoundTrip→tls.Conn.HandshakeContextGO-2026-5972encoding/asn1Spinner.Stop→sync.Once.Do→asn1.UnmarshalGO-2026-5026net/httpIDNA handlinggen.Client.ZoneCheck→http.Client.DoThree were filed 2026-08-13 at 21:43 UTC, roughly nineteen hours after that branch's last green run. The code stood still and the advisory database moved — which is the argument for running this on every push rather than only when something changes.
The fix
setup-goresolves the toolchain from thegodirective ingo.mod, and the job setsGOTOOLCHAIN=local, so CI builds against exactly that patch release and reports every stdlib advisory filed against it. Bumping the directive to1.26.6is both the fix and the reason that directive carries a patch version at all.The
govulncheckstep now says so in a comment, so the next person to see this fail looks at the standard library before hunting through a diff that isn't at fault.Verification
Run locally on
go1.26.6:govulncheck ./...→ No vulnerabilities found. The two remaining findings are in modules we require but don't call.go test -count=1 ./...→ all 18 packages passmake lint→ 0 issuesmake verify-generate→ generated code up to datego mod tidy→ no further changes (the release job'sbeforehook runs this)Note
This raises the minimum build requirement to Go 1.26.6, documented in
CONTRIBUTING.md. Anyone onGOTOOLCHAIN=auto(the default) downloads it transparently; the pin only bites where a toolchain is fixed, as in CI.Nothing here changes runtime behavior — same code, newer compiler.