From b4d9d6dcc3d844e7f042e590544b29bdba4269d5 Mon Sep 17 00:00:00 2001 From: szibis Date: Sat, 12 Sep 2026 18:21:29 +0200 Subject: [PATCH] ci: bump govulncheck to v1.8.0 so the call-graph build survives Go 1.27 v1.1.4 bundles golang.org/x/tools v0.29.0, whose SSA builder panics with 'unexpected expr: *ast.KeyValueExpr' when it builds a call graph for code type-checked as Go 1.27. The panic only triggers once the vulnerability database matches something in the Linux module graph, so the first Go 1.27 run passed and every later run on main and open PRs failed at Govulncheck. Reproduced locally with GOOS=linux; v1.8.0 completes with no findings. --- .github/workflows/ci.yaml | 2 +- CHANGELOG.md | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 0b3524b9..f3b97e7d 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -39,7 +39,7 @@ jobs: run: go vet ./... - name: Govulncheck - run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./... + run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./... - name: Unit tests run: go test ./... -count=1 -race -coverprofile=coverage.out diff --git a/CHANGELOG.md b/CHANGELOG.md index fb68a17c..ccff092a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -66,6 +66,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 `Content-Type: application/json`, G118 on the drilldown field batcher goroutine that intentionally outlives a single request). The rationale is recorded next to the exclusion list in `security-pr.yaml`. +- **CI: govulncheck v1.1.4 → v1.8.0.** v1.1.4 bundles `golang.org/x/tools` + v0.29.0, whose SSA builder panics (`unexpected expr: *ast.KeyValueExpr`) when + it has to build a call graph for code type-checked as Go 1.27. The panic only + fires once the vulnerability database matches something in the Linux module + graph, which is why the first Go 1.27 run passed and every later run on + `main` and on open PRs failed at the `Govulncheck` step. Reproduced locally + with `GOOS=linux`; v1.8.0 completes and reports no vulnerabilities. - **CI: pinned GitHub Actions SHAs bumped** (actions-minor group, 9 updates across the workflow files). - **CI changelog gate:** paths under `website/` are now treated as