From 8189301193b9d60d31d8a237e2b6b1a78fdf5d10 Mon Sep 17 00:00:00 2001 From: Nicholas Sollazzo Date: Fri, 10 Jul 2026 11:06:18 +0200 Subject: [PATCH] build: bump Go toolchain to 1.26.5 to fix GO-2026-5856 (crypto/tls) govulncheck flags GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls, fixed in go1.26.5), reachable via the http.Client/TLS paths in internal/auth and internal/selfupdate. This is pre-existing on main and turns the hygiene CI job red on every PR. Pin the toolchain to go1.26.5 so setup-go (go-version-file: go.mod) and local builds use the fixed stdlib. `make vuln` now reports no vulnerabilities; `go mod tidy -diff` is clean. Language floor stays at go 1.26. POS-197 Co-Authored-By: Claude Opus 4.8 --- go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/go.mod b/go.mod index 3ca7245..46ac3b5 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/positronick/cli go 1.26 +toolchain go1.26.5 + require ( github.com/google/jsonschema-go v0.4.3 github.com/modelcontextprotocol/go-sdk v1.6.1