Skip to content

Require Go 1.26.4#489

Merged
robzolkos merged 1 commit into
mainfrom
fix-go-1.26.4-security
Jun 3, 2026
Merged

Require Go 1.26.4#489
robzolkos merged 1 commit into
mainfrom
fix-go-1.26.4-security

Conversation

@robzolkos
Copy link
Copy Markdown
Collaborator

@robzolkos robzolkos commented Jun 3, 2026

Summary

  • require Go 1.26.4 so GitHub Actions installs the patched standard library
  • resolves govulncheck findings GO-2026-5039 and GO-2026-5037 seen on PR Bc5 assets #488

Tests

  • GOWORK=off GOTOOLCHAIN=go1.26.4 bin/ci
  • GOWORK=off GOTOOLCHAIN=go1.26.4 govulncheck -tags dev ./...

Summary by cubic

Require Go 1.26.4 so CI installs the patched standard library and clears govulncheck advisories GO-2026-5039 and GO-2026-5037. Updates go.mod from 1.26 to 1.26.4.

  • Migration
    • Update your Go toolchain to 1.26.4, or set GOTOOLCHAIN=go1.26.4 for builds/tests.
    • Verify locally with govulncheck -tags dev ./... or run bin/ci.

Written for commit 1e07fe5. Summary will update on new commits.

Review in cubic

Copilot AI review requested due to automatic review settings June 3, 2026 17:04
@github-actions github-actions Bot added deps bug Something isn't working labels Jun 3, 2026
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Re-trigger cubic

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the module’s required Go version to Go 1.26.4 so CI (via actions/setup-go using go-version-file: go.mod) installs a patched standard library and clears the referenced govulncheck findings.

Changes:

  • Bump go.mod Go version from 1.26 to 1.26.4.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@robzolkos robzolkos merged commit 327a22a into main Jun 3, 2026
27 checks passed
@robzolkos robzolkos deleted the fix-go-1.26.4-security branch June 3, 2026 17:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working deps

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants