go 1.27.2: fix the standard library vulnerabilities govulncheck reports #19

Merged

jcoffey-dev merged 3 commits from fix/go-1.27.2 into main 2026-10-09 21:39:20 +00:00

Conversation 0 Commits 3 Files Changed 4

+11 -8

jcoffey-dev commented 2026-10-09 21:03:15 +00:00

Owner

Copy link

Copy source

govulncheck fails CI on main (and on every open PR) with Go standard-library advisories GO-2026-6607..6617 (net/http, http2, crypto/tls, net/textproto), fixed in go1.27.2. Also golang.org/x/net v0.58.0 -> v0.60.0 (same advisories in its http2).

• go.mod: go 1.27.2
• .gitea/workflows/ci.yml: golang job image digest bumped to the current tag (= 1.27.2); Gitea's images run with GOTOOLCHAIN=local, so the old digest would refuse the new go line.

Local: go build ./..., go vet ./..., go test -count=1 ./..., govulncheck ./... (no vulnerabilities called).

govulncheck fails CI on main (and on every open PR) with Go standard-library advisories GO-2026-6607..6617 (net/http, http2, crypto/tls, net/textproto), fixed in go1.27.2. Also golang.org/x/net v0.58.0 -> v0.60.0 (same advisories in its http2). - `go.mod`: go 1.27.2 - `.gitea/workflows/ci.yml`: golang job image digest bumped to the current tag (= 1.27.2); Gitea's images run with GOTOOLCHAIN=local, so the old digest would refuse the new go line. Local: `go build ./...`, `go vet ./...`, `go test -count=1 ./...`, `govulncheck ./...` (no vulnerabilities called).

jcoffey-dev added 1 commit 2026-10-09 21:03:15 +00:00

go 1.27.2: fix the standard library vulnerabilities govulncheck reports ... 4558125832

govulncheck fails CI on main: net/http, net/http/internal/http2,
crypto/tls and net/textproto advisories (GO-2026-6607 to GO-2026-6617)
fixed in go1.27.2. Also golang.org/x/net v0.58.0 -> v0.60.0 (same advisories in its http2). The Gitea job image digest moves to the
current golang tag, which is 1.27.2, so a Gitea build uses the same
toolchain as GitHub's go-version-file.

jcoffey-dev added 2 commits 2026-10-09 21:37:38 +00:00

build: pull base images through mirror.gcr.io ... 8660eed25e

GitHub's shared runners keep hitting Docker Hub's anonymous pull limit
(429 on node, alpine), failing docker-build on every PR and blocking the
release build. mirror.gcr.io serves the same official images (digests
checked against Docker Hub on 2026-10-09) without that limit.

Merge remote-tracking branch 'origin/build/base-images-from-mirror-gcr' into fix/go-1.27.2 d471bbcd9b

jcoffey-dev merged commit dc1c7c8729 into main 2026-10-09 21:39:20 +00:00

jcoffey-dev deleted branch fix/go-1.27.2 2026-10-09 21:39:20 +00:00

jcoffey-dev referenced this pull request 2026-10-09 21:41:15 +00:00

build: pull base images through mirror.gcr.io #20

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

Dependency updates

documentation

Docs, README or site copy

duplicate

Already tracked elsewhere

enhancement

New feature or improvement

good first issue

Good for newcomers

help wanted

Contributions welcome

invalid

Not a valid issue

needs info

Waiting on the reporter for details

question

Needs an answer, not a code change

security

Security issue or hardening

translation

New language or translation fixes

wontfix

Will not be worked on

priority

p1

High priority

priority

p2

Medium priority

priority

p3

Low priority

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jcoffey-dev (John Coffey)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coffey-labs/ihasvpn#19