From ed6c48c9ccdb439d48c0493344294a019da9ce1e Mon Sep 17 00:00:00 2001 From: Olof Mattsson Date: Mon, 10 Aug 2026 14:16:11 +0200 Subject: [PATCH] build(deps): bump Go to 1.26.5 (fix GO-2026-5856) + x/term, docker, setup-go Root fix: cli/go.mod `go 1.26.4` -> `1.26.5`. All workflows install Go via `go-version-file: cli/go.mod`, so CI was building with the vulnerable 1.26.4 stdlib and govulncheck failed on GO-2026-5856 (crypto/tls, fixed in 1.26.5) for every PR. Consolidates the open Dependabot PRs: - golang.org/x/term 0.44.0 -> 0.45.0 (#110) - Dockerfile golang 1.26.4-alpine -> 1.26.5-alpine (#109) - actions/setup-go v6 -> v7 across all workflows (#111) Local: go mod tidy, go vet, go build, go test, and govulncheck v1.1.4 all pass ("No vulnerabilities found"). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 6 +++--- .github/workflows/live-tests.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/security.yml | 4 ++-- Dockerfile | 2 +- cli/go.mod | 6 +++--- cli/go.sum | 8 ++++---- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0db040c..2ae49e1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: working-directory: cli steps: - uses: actions/checkout@v7 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v7 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum @@ -47,7 +47,7 @@ jobs: working-directory: cli steps: - uses: actions/checkout@v7 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v7 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum @@ -64,7 +64,7 @@ jobs: working-directory: cli steps: - uses: actions/checkout@v7 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v7 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum diff --git a/.github/workflows/live-tests.yml b/.github/workflows/live-tests.yml index f49c974..3c2ae94 100644 --- a/.github/workflows/live-tests.yml +++ b/.github/workflows/live-tests.yml @@ -37,7 +37,7 @@ jobs: uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@v7 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4dd196a..67d2def 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,7 +16,7 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v7 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d51b6a0..cbe6d35 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,7 +21,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v7 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum @@ -41,7 +41,7 @@ jobs: steps: - uses: actions/checkout@v7 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v7 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum diff --git a/Dockerfile b/Dockerfile index ffdad30..acaf037 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Stage 1: Build -FROM golang:1.26.4-alpine AS builder +FROM golang:1.26.5-alpine AS builder ARG VERSION=dev ARG COMMIT=none diff --git a/cli/go.mod b/cli/go.mod index ebc991a..b23b19b 100644 --- a/cli/go.mod +++ b/cli/go.mod @@ -1,6 +1,6 @@ module github.com/omattsson/stackctl/cli -go 1.26.4 +go 1.26.5 require ( github.com/gorilla/websocket v1.5.3 @@ -9,7 +9,7 @@ require ( github.com/spf13/pflag v1.0.10 github.com/stretchr/testify v1.11.1 go.uber.org/goleak v1.3.0 - golang.org/x/term v0.44.0 + golang.org/x/term v0.45.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -17,5 +17,5 @@ require ( github.com/davecgh/go-spew v1.1.1 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/kr/text v0.2.0 // indirect - golang.org/x/sys v0.46.0 // indirect + golang.org/x/sys v0.47.0 // indirect ) diff --git a/cli/go.sum b/cli/go.sum index 1d45f9b..e38cc1f 100644 --- a/cli/go.sum +++ b/cli/go.sum @@ -23,10 +23,10 @@ github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=