From 8a674a90b2c85c6eef2f8dedf3165376e7ae72db Mon Sep 17 00:00:00 2001 From: Pedro Gomes Date: Sun, 16 Aug 2026 14:17:03 +0100 Subject: [PATCH] fix(ci): build on Go 1.26.6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit go.mod declared `go 1.26.0` with no `toolchain` line, and both workflows resolve their Go from `go-version-file: go.mod` — so every build here has been running Go 1.26.0, with the whole 1.26 patch series of stdlib fixes missing. Nothing reported it, because a stale toolchain is not a dependency: Dependabot covers gomod and github-actions, and the Go release is neither. The same gap was found in gt (pedromvgomes/gt#31), where bulwark's govulncheck stage surfaced 18 advisories against exactly this cause. `toolchain go1.26.6` is the newest 1.26 patch. The `go` directive stays at 1.26.0, since that is the minimum language version rather than the toolchain to build with — the same split wardnet uses. Verified with govulncheck ./... on 1.26.6: no vulnerabilities found. Claude-Session: https://claude.ai/code/session_01PvwKxJ5vnqa9h9XXyTEj43 --- go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/go.mod b/go.mod index 8784b6f..e876e95 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/pedromvgomes/agentic-toolkit go 1.26.0 +toolchain go1.26.6 + require github.com/goccy/go-yaml v1.19.2 require (