fix(ci): build on Go 1.26.6 - #49
Merged
Merged
Conversation
go.mod declared `go 1.26.0` with no `toolchain` line, and both workflows resolve their Go from `go-version-file: go.mod` — so every build here has been running Go 1.26.0, with the whole 1.26 patch series of stdlib fixes missing. Nothing reported it, because a stale toolchain is not a dependency: Dependabot covers gomod and github-actions, and the Go release is neither. The same gap was found in gt (pedromvgomes/gt#31), where bulwark's govulncheck stage surfaced 18 advisories against exactly this cause. `toolchain go1.26.6` is the newest 1.26 patch. The `go` directive stays at 1.26.0, since that is the minimum language version rather than the toolchain to build with — the same split wardnet uses. Verified with govulncheck ./... on 1.26.6: no vulnerabilities found. Claude-Session: https://claude.ai/code/session_01PvwKxJ5vnqa9h9XXyTEj43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
go.moddeclaredgo 1.26.0with notoolchainline, and bothworkflows resolve their Go from
go-version-file: go.mod. So every buildhere has been running Go 1.26.0, with the entire 1.26 patch series of stdlib
fixes missing.
Straight from the last CI run on
main:Nothing reported it, because a stale toolchain is not a dependency:
Dependabot covers
gomodandgithub-actions, and the Go release isneither.
Found while fixing the same gap in gt (pedromvgomes/gt#31), where bulwark's
govulncheck stage surfaced 18 stdlib advisories traced to exactly this
cause —
crypto/tls,crypto/x509,net/http,net/url,encoding/asn1,archive/tarandos, with the last fixes landing in 1.26.6.toolchain go1.26.6is the newest 1.26 patch. Thegodirective stays at1.26.0, since that is the minimum language version rather than thetoolchain to build with — the same split wardnet uses.
On verification
I can't reproduce the 1.26.0 build locally — my toolchain is already 1.26.6
and Go uses it whenever it satisfies the
godirective. So the evidencehere is the CI log above plus setup-go's documented behaviour: with a
toolchainline it installs that version. The proof this actually workedis this PR's own CI run, which should now report 1.26.6.
Locally on 1.26.6,
govulncheck ./...reports your code is affected by 0vulnerabilities and the full test suite passes. It does list 23
vulnerabilities in modules required but never imported or called — those are
third-party, unrelated to the toolchain, and unchanged by this PR.
Independent of the gt governance work (#48) and
can merge now.