[gmegidish]

Problem

make vulncheck failed: 10 Go standard library vulnerabilities reachable from our code (net/http, net/textproto, crypto/tls, crypto/x509; GO-2026-6603…6613, GO-2026-6809), fixed in go1.26.9 / go1.26.10. golang.org/x/net v0.57.0 also carried GO-2026-6610…6617 (fixed in v0.60.0) and GO-2026-6860/6866 (fixed in v0.62.0).

Fix

• toolchain go1.26.6 → go1.26.10 (CI picks it up through go-version-file: go.mod)
• golang.org/x/net v0.57.0 → v0.62.0; go mod tidy moved the other golang.org/x modules along

Result

Your code is affected by 0 vulnerabilities.

Not included

3 vulnerabilities remain in modules we require, but none are reachable from our code:

• quic-go v0.49.1 (GO-2026-5676, GO-2025-4233): it is pinned by a replace, because go-ios v1.0.211 still uses quic.Connection, which quic-go v0.59 renamed. Fixing it means upgrading go-ios to v1.3.x, which touches the real-device tunnel and should be its own PR.
• golang.org/x/crypto (GO-2026-5932): there is no fixed version yet.

Testing

• go build ./..., go vet ./..., go test ./... all pass
• make vulncheck: no vulnerabilities reachable from our code

Summary by CodeRabbit

• Chores
  • Updated the Go toolchain and supporting components to newer versions. These updates affect the software’s underlying build environment; they do not add, remove, or change user-facing features or behavior. No other end-user-visible changes are included in this release.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: mobile-next/mobilecli
• Branch: chore/vulncheck-go-1.26.10
• File: .coderabbit.yaml
• Commit: b784385
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Essentials
• Run ID: 8505ffc0-dd3d-4bda-bac9-f609dd9a00db

Commits

Reviewing files that changed from the base of the PR and between 36c5193 and b784385.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Walkthrough

The Go toolchain directive changes from Go 1.26.6 to Go 1.26.10. Versions of seven indirect golang.org/x dependencies are updated. The x/exp and x/time versions remain unchanged.

Changes: Go module updates

Layer / File(s)	Summary
Toolchain and dependency versions go.mod	The toolchain directive and selected indirect dependency versions are updated. The x/exp and x/time entries remain unchanged.

Estimated code review effort: 1 (Trivial) | ~4 minutes

Merge Risk: Minimal · up to b7843

The toolchain and dependency updates are ready to merge based on the supplied review evidence.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main changes: the Go toolchain and golang.org/x/net updates.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR