coffey-labs/ihasmail-oneshot
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity Sponsor

go 1.26.9: fix the standard library vulnerabilities govulncheck reports #18

Merged
jcoffey-dev merged 1 commits from fix/go-1.26.9 into main 2026-10-09 21:13:38 +00:00
Conversation 0 Commits 1 Files Changed 2
+4 -4
jcoffey-dev commented 2026-10-09 21:03:24 +00:00
Owner
Copy link
Copy source

govulncheck fails CI on main (and on every open PR) with Go standard-library advisories GO-2026-6607..6617 (net/http, http2, crypto/tls, net/textproto), fixed in go1.26.9.

  • go.mod: go 1.26.9
  • .gitea/workflows/ci.yml: golang job image digest bumped to the current tag (= 1.26.9); Gitea's images run with GOTOOLCHAIN=local, so the old digest would refuse the new go line.

Local: go build ./..., go vet ./..., go test -count=1 ./..., govulncheck ./... (no vulnerabilities called).

govulncheck fails CI on main (and on every open PR) with Go standard-library advisories GO-2026-6607..6617 (net/http, http2, crypto/tls, net/textproto), fixed in go1.26.9. - `go.mod`: go 1.26.9 - `.gitea/workflows/ci.yml`: golang job image digest bumped to the current tag (= 1.26.9); Gitea's images run with GOTOOLCHAIN=local, so the old digest would refuse the new go line. Local: `go build ./...`, `go vet ./...`, `go test -count=1 ./...`, `govulncheck ./...` (no vulnerabilities called).
jcoffey-dev added 1 commit 2026-10-09 21:03:24 +00:00
go 1.26.9: fix the standard library vulnerabilities govulncheck reports
ci / test (pull_request) Skipped
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 1m16s
Details
ci / release (pull_request) Skipped
Details
ci / announce (pull_request) Skipped
Details
c71ef7e4fc 
govulncheck fails CI on main: net/http, net/http/internal/http2,
crypto/tls and net/textproto advisories (GO-2026-6607 to GO-2026-6617)
fixed in go1.26.9. The Gitea job image digest moves to the
current golang tag, which is 1.26.9, so a Gitea build uses the same
toolchain as GitHub's go-version-file.
jcoffey-dev merged commit 2535c8b89d into main 2026-10-09 21:13:38 +00:00
jcoffey-dev deleted branch fix/go-1.26.9 2026-10-09 21:13:38 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something isn't working
 dependencies
Dependency updates
 documentation
Docs, README or site copy
 duplicate
Already tracked elsewhere
 enhancement
New feature or improvement
 good first issue
Good for newcomers
 help wanted
Contributions welcome
 invalid
Not a valid issue
 needs info
Waiting on the reporter for details
 question
Needs an answer, not a code change
 security
Security issue or hardening
 translation
New language or translation fixes
 wontfix
Will not be worked on
priority
p1
High priority
priority
p2
Medium priority
priority
p3
Low priority
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcoffey-dev (John Coffey)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coffey-labs/ihasmail-oneshot#18