From 4ece649c3612b3cbdc37cee47f3715a37f07f1de Mon Sep 17 00:00:00 2001 From: patramsey Date: Mon, 17 Aug 2026 21:11:20 -0600 Subject: [PATCH] fix: build against Go 1.26.6 to clear four reachable stdlib advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI's Vulnerabilities job went red on main at 70571c8 — a commit that touched only .goreleaser.yaml. The diff was not the cause. govulncheck found four standard-library advisories reachable from this binary, all fixed in go1.26.6: GO-2026-6218 quadratic complexity in net/url.resolvePath GO-2026-6090 unbounded post-handshake messages in crypto/tls GO-2026-5972 recursion depth in encoding/asn1 GO-2026-5026 ASCII-only Punycode labels in net/http's IDNA handling Three were filed on 2026-08-13 at 21:43 UTC, about nineteen hours after that branch's last green run. So the code stood still and the advisory database moved — which is the whole point of running this on every push rather than only when something changes. setup-go resolves the toolchain from the `go` directive in go.mod, and the job sets GOTOOLCHAIN=local, so CI builds against exactly that patch release. Bumping the directive to 1.26.6 is therefore both the fix and the reason the directive carries a patch version in the first place; the govulncheck step now says so, so the next person to see this fail looks at the stdlib before hunting through a diff that is not at fault. Verified locally on go1.26.6: govulncheck reports no vulnerabilities, the remaining two findings being in modules we require but do not call. Tests, lint, verify-generate, and go mod tidy are all clean. Raises the minimum build requirement to Go 1.26.6. --- .github/workflows/ci.yml | 10 ++++++++++ CHANGELOG.md | 10 ++++++++++ CONTRIBUTING.md | 5 ++++- go.mod | 2 +- 4 files changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index edf6405..71d8df5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -101,6 +101,16 @@ jobs: # is the same mutable-upstream exposure the SHA-pinned actions above # exist to remove. Dependabot does not manage `go install` versions, so # this one is bumped by hand. + # + # When this step fails on a commit that changed no code, suspect the + # Go standard library before suspecting the diff. `setup-go` resolves + # the toolchain from the `go` directive in go.mod and GOTOOLCHAIN is + # `local`, so CI builds against exactly that patch release and reports + # every stdlib advisory filed against it. Three landed against 1.26.5 + # five days after the last green run and turned main red on a + # goreleaser-config change. The fix in that case is to bump the patch + # version in go.mod to the release named in `Fixed in:`, which is why + # that directive carries a patch version at all. run: | go install golang.org/x/vuln/cmd/govulncheck@v1.6.0 govulncheck ./... diff --git a/CHANGELOG.md b/CHANGELOG.md index e93b206..7a4fbc2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,16 @@ Releases before `0.2.0` predate this file. Their notes are on the ## [Unreleased] +### Security +- The Go toolchain moves to 1.26.6, clearing four standard-library + advisories that `govulncheck` found reachable from this binary: + `GO-2026-6218` (quadratic complexity in `net/url.resolvePath`), + `GO-2026-6090` (unbounded post-handshake messages in `crypto/tls`), + `GO-2026-5972` (recursion depth in `encoding/asn1`), and `GO-2026-5026` + (ASCII-only Punycode labels in `net/http`'s IDNA handling). Three were + filed on 2026-08-13, after the last green build; no code here changed. + Building now needs Go 1.26.6. + ## [0.2.3] - 2026-08-02 ### Added diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c1bc3b5..cf48d9a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,7 +9,10 @@ Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md). ## Development setup -Requires Go 1.26+ and Python 3 (only for `make generate`). +Requires Go 1.26.6+ and Python 3 (only for `make generate`). The `go` +directive in `go.mod` carries a patch version because CI's `govulncheck` +step resolves the toolchain from it — see the comment on that step in +`.github/workflows/ci.yml`. ```bash git clone https://github.com/patramsey/namecom-cli.git diff --git a/go.mod b/go.mod index d6b35f6..31fcbb3 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/patramsey/namecom-cli -go 1.26.5 +go 1.26.6 require ( github.com/charmbracelet/huh v1.0.0