From adb51096043a7f05d787613c04c60c47dea1e19c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= Date: Mon, 26 Oct 2026 10:26:21 +0100 Subject: [PATCH 1/2] ci: build with the latest Go patch release setup-go reads "go 1.27.0" in go.mod as an exact version, so check-latest never applied: Windows and macOS release binaries shipped with Go 1.27.0, affected by GO-2026-6617 (HTTP/2 HPACK encoder race, fixed in 1.27.2). Without a patch number, setup-go resolves the latest 1.27 release. --- caddy/go.mod | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/caddy/go.mod b/caddy/go.mod index 5ec17d67a7..071b9cd975 100644 --- a/caddy/go.mod +++ b/caddy/go.mod @@ -1,6 +1,6 @@ module github.com/dunglas/frankenphp/caddy -go 1.27.0 +go 1.27 replace github.com/dunglas/frankenphp => ../ diff --git a/go.mod b/go.mod index 5bdf3653d2..51e74e5968 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/dunglas/frankenphp -go 1.27.0 +go 1.27 retract v1.0.0-rc.1 // Human error From cb37041f2dca95222c34db5ce0c5f3a0b91ed444 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= Date: Mon, 26 Oct 2026 10:26:26 +0100 Subject: [PATCH 2/2] ci: reject Go patch releases in go.mod A patch release in the go or toolchain directive pins CI to it and goes stale, and go get adds them back on its own. --- .github/workflows/lint.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 6b2989a81a..231d387c80 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -24,6 +24,13 @@ jobs: with: fetch-depth: 0 persist-credentials: false + # A patch release in go.mod stops setup-go from picking the latest one + - name: Reject Go patch releases in go.mod + run: | + if git ls-files -z '*go.mod' | xargs -0 grep -nE '^(toolchain |go [0-9]+\.[0-9]+\.)'; then + echo "::error::Use the minor version only (go mod edit -go=1.N -toolchain=none)" + exit 1 + fi - name: Lint Code Base uses: super-linter/super-linter/slim@2da136927bd4a73596db63044b504547c62cb854 # v9.0.0 env: