coffey-labs/stalwart-migrator
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity Sponsor

Build with Go 1.26.10 for GO-2026-6809 #22

Merged
jcoffey-dev merged 1 commits from fix/go-1.26.10 into main 2026-10-27 06:56:38 +00:00
Conversation 0 Commits 1 Files Changed 2
+4 -4
jcoffey-dev commented 2026-10-27 06:54:56 +00:00
Owner
Copy link
Copy source

CI started failing on every branch: govulncheck reports GO-2026-6809 (crypto/x509, distrust compromised intermediate certificates), reachable from backup.VerifyDataDirBackup, found in go1.26.9 and fixed in go1.26.10.

  • go.mod: go 1.26.10 (the GitHub runners read it via go-version-file).
  • .gitea/workflows/ci.yml: the fallback golang:1.26-bookworm image re-pinned to the digest that ships 1.26.10.

Checked in that image: go vet, go test ./... all pass, govulncheck: no vulnerabilities found.

CI started failing on every branch: govulncheck reports [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809) (crypto/x509, distrust compromised intermediate certificates), reachable from `backup.VerifyDataDirBackup`, found in go1.26.9 and fixed in go1.26.10. - `go.mod`: `go 1.26.10` (the GitHub runners read it via `go-version-file`). - `.gitea/workflows/ci.yml`: the fallback `golang:1.26-bookworm` image re-pinned to the digest that ships 1.26.10. Checked in that image: `go vet`, `go test ./...` all pass, govulncheck: no vulnerabilities found.
jcoffey-dev added 1 commit 2026-10-27 06:54:56 +00:00
Build with Go 1.26.10 for GO-2026-6809
ci / test (pull_request) Skipped
Details
ci / release (pull_request) Skipped
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 1m9s
Details
ci / announce (pull_request) Skipped
Details
dc32032520 
govulncheck reports GO-2026-6809 (crypto/x509 distrusting compromised
intermediates) reachable from backup verification on Go 1.26.9; 1.26.10 fixes
it. go.mod drives the GitHub runners; the Gitea fallback image is re-pinned to
the 1.26-bookworm digest that ships 1.26.10.
jcoffey-dev merged commit 6d87be6d69 into main 2026-10-27 06:56:38 +00:00
jcoffey-dev deleted branch fix/go-1.26.10 2026-10-27 06:56:38 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something isn't working
 dependencies
Dependency updates
 documentation
Docs, README or site copy
 duplicate
Already tracked elsewhere
 enhancement
New feature or improvement
 good first issue
Good for newcomers
 help wanted
Contributions welcome
 invalid
Not a valid issue
 needs info
Waiting on the reporter for details
 question
Needs an answer, not a code change
 security
Security issue or hardening
 translation
New language or translation fixes
 wontfix
Will not be worked on
priority
p1
High priority
priority
p2
Medium priority
priority
p3
Low priority
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcoffey-dev (John Coffey)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coffey-labs/stalwart-migrator#22