From 51804e250cfc3417579ae8aae9b51cd9315b6149 Mon Sep 17 00:00:00 2001 From: Oscar Sanderson Date: Sat, 19 Sep 2026 16:03:45 +0800 Subject: [PATCH] fix: bump Go toolchain to 1.26.6 for 6 stdlib CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck ./... flags 6 vulnerabilities in Go 1.26.5's standard library that this module's own code actually reaches: crypto/tls (GO-2026-6090, post-handshake message limits), net/http (GO-2026-6089, ReadHeaderTimeout on unencrypted HTTP/2 upgrade; GO-2026-5026, idna Punycode label rejection), net/url (GO-2026-6218, quadratic resolvePath), html/template (GO-2026-6091, JS regexp context tracking — cmd/conformance-as's own consent-approval UI), and encoding/asn1 (GO-2026-5972, recursion depth — internal/jose's ECDSA signature parsing). All six are fixed in Go 1.26.6; govulncheck finds zero vulnerabilities once the toolchain is bumped. No source changes — go.mod's go directive is the version CI's own setup-go step reads, so this is what actually closes the gap. The two Dockerfiles (conformance/server, cmd/conformance-federation-trust-anchor) use the floating `golang:1.26` tag already, so they pick up 1.26.6 on their next pull/build without a Dockerfile change. Co-Authored-By: Claude Sonnet 5 --- README.md | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e76ba9a..eb2acae 100644 --- a/README.md +++ b/README.md @@ -61,7 +61,7 @@ variants. > **⚠ Work in progress.** FAPIgo is under active development. APIs, package structure, and behavior may change without notice. We recommend waiting for the v1.0 release before considering it for production use. -Requires Go 1.26.5+ (per `go.mod`'s `go` directive). +Requires Go 1.26.6+ (per `go.mod`'s `go` directive). ``` go get github.com/idfoundry/fapigo diff --git a/go.mod b/go.mod index e11ef36..ae200be 100644 --- a/go.mod +++ b/go.mod @@ -1,3 +1,3 @@ module github.com/idfoundry/fapigo -go 1.26.5 +go 1.26.6