From ec7569b5a5a4f81e7fdf6d880e7ef456c8f082fc Mon Sep 17 00:00:00 2001 From: amcheste-ai-agent <278991699+amcheste-ai-agent@users.noreply.github.com> Date: Fri, 21 Aug 2026 21:33:18 -0400 Subject: [PATCH] fix: bump Go toolchain to 1.26.7 to clear stdlib CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck has been failing on develop since 2026-08-18, blocking every open PR. The failure is not caused by any code change — six standard library advisories landed in the Go vulnerability database, all fixed in go1.26.6: GO-2026-6218 net/url GO-2026-6091 html/template GO-2026-6090 crypto/tls GO-2026-6089 net/http GO-2026-5972 encoding/asn1 GO-2026-5026 net/http (idna punycode) Every workflow resolves its Go version via setup-go with go-version-file: go.mod, which honours the toolchain directive, so the go1.26.5 pin was what CI actually built with. Bumping to go1.26.7 (the current latest patch) picks up the fixes everywhere at once. Co-Authored-By: Claude Opus 5 Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com> --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 2331a14..2c916da 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/amcheste/kagents go 1.26.0 -toolchain go1.26.5 +toolchain go1.26.7 require ( github.com/go-logr/logr v1.4.4