From af024659d2bdb8054c724803cedce0031868b74e Mon Sep 17 00:00:00 2001 From: DonislawDev Date: Wed, 16 Sep 2026 09:58:02 +0200 Subject: [PATCH] ci: govulncheck v1.7.0 -> v1.8.0, run on the tree first The weekly tool-versions run has been reporting this pin as behind since 2026-09-14. v1.8.0 is the newest version the module index lists, and it was run on this tree before the pin moved: no vulnerabilities found, exit 0 under Go 1.27, the same verdict v1.7.0 gives. Checked rather than assumed because the two pins before this one had stopped working with the compiler without anybody noticing. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9b7ef2f..3b1f44a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -339,7 +339,10 @@ jobs: # what makes it worth having: a scanner that lists every advisory # touching the module graph produces noise, and noise gets switched off. # Measured before switching it on, 2026-08-02: no vulnerabilities found. - run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 -tags "$(cat .github/build-tags)" ./... + # v1.8.0 since 2026-09-16, run on the tree before the pin moved: the same + # verdict as v1.7.0, exit 0 under Go 1.27 - the two pins before this one + # had stopped working with the compiler without anybody noticing. + run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 -tags "$(cat .github/build-tags)" ./... staticcheck: name: staticcheck