From c71ef7e4fcdd5a1df3e8bc4c1c3090adda415130 Mon Sep 17 00:00:00 2001
From: John Coffey <john@coffeylabs.org>
Date: Fri, 9 Oct 2026 14:03:15 -0700
Subject: [PATCH] go 1.26.9: fix the standard library vulnerabilities
 govulncheck reports

govulncheck fails CI on main: net/http, net/http/internal/http2,
crypto/tls and net/textproto advisories (GO-2026-6607 to GO-2026-6617)
fixed in go1.26.9. The Gitea job image digest moves to the
current golang tag, which is 1.26.9, so a Gitea build uses the same
toolchain as GitHub's go-version-file.
---
 .gitea/workflows/ci.yml | 6 +++---
 go.mod                  | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f5f172d..4657ebb 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
     if: ${{ vars.BUILD_ON != 'github' }}
     runs-on: light
     container:
-      image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
+      image: golang:1.26-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c # 1.26-bookworm
     steps:
       - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
       - run: go vet ./...
@@ -59,7 +59,7 @@ jobs:
     needs: [test]
     runs-on: light
     container:
-      image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
+      image: golang:1.26-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c # 1.26-bookworm
     steps:
       # Full history: the ancestry check below cannot be answered from a
       # shallow clone. The checkout also fetches every branch as origin/*.
@@ -125,7 +125,7 @@ jobs:
     runs-on: wait
     timeout-minutes: 150
     container:
-      image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
+      image: golang:1.26-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c # 1.26-bookworm
     steps:
       - shell: bash
         env:
diff --git a/go.mod b/go.mod
index bc930cd..527408b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
 module github.com/Coffey-Labs/ihasmail-oneshot
 
-go 1.26.8
+go 1.26.9
-- 
2.54.0