From b7423c4755c11b9c9eca0b8247f2ceb5c770b41a Mon Sep 17 00:00:00 2001 From: Engineer Date: Wed, 21 Oct 2026 08:36:20 +0200 Subject: [PATCH] fix(security): bump Go to 1.26.10 for GO-2026-6809 govulncheck (the Security workflow) fails on master with a standard-library advisory: Vulnerability #1: GO-2026-6809 Distrust compromised intermediate certificates in crypto/x509 Found in: crypto/x509@go1.26.9 Fixed in: crypto/x509@go1.26.10 Trace: fetcher.FetchEmailBodyFromMailbox -> pkcs7.PKCS7.VerifyWithChain -> x509.Certificate.Verify Since go.mod pinned go 1.26.9 and the fix shipped in go1.26.10, bump the module's Go directive and the workflow setup-go pins accordingly. govulncheck ./... now reports "No vulnerabilities found". --- .github/workflows/benchmarks.yml | 2 +- .github/workflows/bot-build.yml | 2 +- .github/workflows/ci.yml | 8 ++++---- .github/workflows/integration.yml | 6 +++--- .github/workflows/nightly.yml | 2 +- .github/workflows/release-rc.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/security.yml | 6 +++--- go.mod | 2 +- 9 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index 6b6ad64e..c2281691 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -22,7 +22,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies run: sudo apt-get update && sudo apt-get install -y libpcsclite-dev diff --git a/.github/workflows/bot-build.yml b/.github/workflows/bot-build.yml index f10fdd69..3a0a8c5e 100644 --- a/.github/workflows/bot-build.yml +++ b/.github/workflows/bot-build.yml @@ -77,7 +77,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Set up Zig uses: goto-bus-stop/setup-zig@v2 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5782da38..a6f13b9d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies if: runner.os == 'Linux' @@ -42,7 +42,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies run: sudo apt-get update && sudo apt-get install -y libpcsclite-dev @@ -74,7 +74,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Check go.mod and go.sum are tidy run: | @@ -230,7 +230,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install GoReleaser uses: goreleaser/goreleaser-action@v7 diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index faa0f007..58546c4d 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -35,7 +35,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies run: sudo apt-get update && sudo apt-get install -y libpcsclite-dev @@ -75,7 +75,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system deps (linux) if: runner.os == 'Linux' @@ -94,7 +94,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies run: sudo apt-get update && sudo apt-get install -y libpcsclite-dev diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 134d7111..abba55c5 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -21,7 +21,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Set up Zig uses: goto-bus-stop/setup-zig@v2 diff --git a/.github/workflows/release-rc.yml b/.github/workflows/release-rc.yml index c8af46e3..242c2891 100644 --- a/.github/workflows/release-rc.yml +++ b/.github/workflows/release-rc.yml @@ -87,7 +87,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Set up Zig uses: goto-bus-stop/setup-zig@v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0809ca15..a2c502f4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Set up Zig uses: goto-bus-stop/setup-zig@v2 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b6c88e11..aaf61231 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -24,7 +24,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies run: sudo apt-get update && sudo apt-get install -y libpcsclite-dev @@ -43,7 +43,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies run: sudo apt-get update && sudo apt-get install -y libpcsclite-dev @@ -109,7 +109,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: "1.26.9" + go-version: "1.26.10" - name: Install system dependencies run: sudo apt-get update && sudo apt-get install -y libpcsclite-dev diff --git a/go.mod b/go.mod index b539890f..59105761 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/floatpane/matcha -go 1.26.9 +go 1.26.10 require ( charm.land/bubbles/v2 v2.2.1