fix: bump Go toolchain to 1.26.6 for 6 stdlib CVEs - #361
Merged
Merged
Conversation
govulncheck ./... flags 6 vulnerabilities in Go 1.26.5's standard library that this module's own code actually reaches: crypto/tls (GO-2026-6090, post-handshake message limits), net/http (GO-2026-6089, ReadHeaderTimeout on unencrypted HTTP/2 upgrade; GO-2026-5026, idna Punycode label rejection), net/url (GO-2026-6218, quadratic resolvePath), html/template (GO-2026-6091, JS regexp context tracking — cmd/conformance-as's own consent-approval UI), and encoding/asn1 (GO-2026-5972, recursion depth — internal/jose's ECDSA signature parsing). All six are fixed in Go 1.26.6; govulncheck finds zero vulnerabilities once the toolchain is bumped. No source changes — go.mod's go directive is the version CI's own setup-go step reads, so this is what actually closes the gap. The two Dockerfiles (conformance/server, cmd/conformance-federation-trust-anchor) use the floating `golang:1.26` tag already, so they pick up 1.26.6 on their next pull/build without a Dockerfile change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A clean full-library security scan (
govulncheck,golangci-lint/gosec,go vet) found one real finding:govulncheck ./...flags 6 vulnerabilities in Go 1.26.5's standard library that this module's own code actually reaches (not just theoretically importable):crypto/tls(GO-2026-6090) — post-handshake message limits, reached via every outbound/inbound TLS connection (fapihttp,backchannelhttp,fapitest).net/http(GO-2026-6089) — missingReadHeaderTimeouton the unencrypted-HTTP/2-upgrade path, reached viacmd/conformance-as/cmd/conformance-federation-trust-anchor/cmd/conformance-client's own listeners.net/http(GO-2026-5026, viagolang.org/x/net/idna) — Punycode label rejection, reached viafapitest/cmd/conformance-client.net/url(GO-2026-6218) — quadraticresolvePath, reached viafapihttp.Client.resolveRedirectand general HTTP client URL parsing.html/template(GO-2026-6091) — JS regexp context tracking, reached viacmd/conformance-as's own consent-approval UI template.encoding/asn1(GO-2026-5972) — recursion depth limit, reached viainternal/jose's ECDSA signature parsing (asn1.Unmarshal).All six are fixed in Go 1.26.6.
govulncheck ./...finds zero vulnerabilities once the toolchain is bumped — verified by actually downloading and building/testing under 1.26.6, not just reading the advisory.No source changes:
go.mod'sgodirective is what CI's ownsetup-gostep (go-version-file: go.mod) reads, so bumping it is what actually closes the gap for CI too — this hasn't shown up as a CI failure yet only because these CVEs were disclosed after the last PR'sgovulncheckrun; the next push would have caught it regardless. The two Dockerfiles (conformance/server,cmd/conformance-federation-trust-anchor) already use the floatinggolang:1.26tag (no patch pin), so they pick up 1.26.6 automatically on their next pull/build.Also updates
README.md's "Requires Go 1.26.5+" line to match.Test plan
gofmt -l .cleango build ./...under Go 1.26.6go vet ./...under Go 1.26.6go test -race ./...under Go 1.26.6 — all packages passgolangci-lint run ./...under Go 1.26.6 — 0 issuesgovulncheck ./...under Go 1.26.6 — 0 vulnerabilities (confirmed both before, showing all 6, and after, showing zero)🤖 Generated with Claude Code
https://claude.ai/code/session_01JCpqoxEg7XUkkGg312zXyS