From dd972795df1c83b724592e9417c77bdc25239756 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 20 Aug 2026 03:10:25 -0700 Subject: [PATCH] Pin the Go toolchain to 1.26.7 to clear three stdlib advisories Govulncheck started failing on every open PR today: GO-2026-6090 (crypto/tls), GO-2026-6089 (net/http) and GO-2026-5972 (encoding/asn1), all reachable, all fixed in go1.26.6. Nothing in the source changed. go.mod carried a bare 'go 1.26', which setup-go resolves as >=1.26.0 <1.27 and satisfies from the runner's tool cache -- go1.26.5. Once the advisories landed, that cached patch was vulnerable and every build inherited it. Patch-pinning the go directive makes setup-go install an exact version, and covers all eight setup-go steps at once since they all read go-version-file: go.mod. It also matches kamal-proxy, once and basecamp-installer, which already patch-pin and carry no toolchain directive. Verified against the same tree: 3 vulns under go1.26.5, none under 1.26.6 or 1.26.7. build, vet, gofmt and the test suite pass on 1.26.7. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index db77c4a..8db3691 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/basecamp/cli -go 1.26 +go 1.26.7 require ( github.com/spf13/cobra v1.10.2