fix(deps): move to Go 1.26.5 for the crypto/tls advisory - #39
Merged
Conversation
govulncheck fails on every pull request, and on main too -- not from any code change. It queries the live vulnerability database, so GO-2026-5856 turned CI red the day it was published: Vulnerability #1: GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls Found in: crypto/tls@go1.26.4 Fixed in: crypto/tls@go1.26.5 It is in the standard library, not a dependency, so no code change fixes it -- only the toolchain does. And it is reachable, not theoretical: the first trace govulncheck reports is updater.httpGet calling http.Client.Do, i.e. the path that downloads a release. CI takes its toolchain from go.mod (`go-version-file: go.mod`), so this one line moves the compiler for every job. Verified by running it: govulncheck reproduced the failure locally on 1.26.4 (exit 3) and reports "No vulnerabilities found" (exit 0) on 1.26.5. build, vet and the updater/lynxfile tests all pass. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
govulncheckis failing on every pull request here, and onmaintoo — not from any code change. It queries the live vulnerability database, so a newly published advisory turns CI red on its own.mainwas green on 2026-07-07; the advisory landed since.It's in the standard library, not a dependency, so no code change fixes it — only the toolchain does.
And it's reachable, not theoretical. The first trace govulncheck reports is the release updater:
That's the path that downloads a release over TLS.
CI takes its toolchain from
go.mod(go-version-file: go.mod), which is the right design — the version is pinned, not floating. So this one line moves the compiler for every job.Verified by running it, not reading it (Go 1.26.4 → 1.26.5, locally):
govulncheck ./...Your code is affected by 1 vulnerability, exit 3No vulnerabilities found, exit 0go build,go vetand theupdater/lynxfiletests all pass on 1.26.5.Unblocks #32 and #38, which are both red on this and have nothing to do with it.