Repository navigation
security: bump Go to 1.26.2 — 4 stdlib vulns flagged by govulncheck #95
Description
Failures
dependency-audit / govulncheck is failing on main against the new centralized reusable. Four standard-library vulnerabilities, all fixed in Go 1.26.2:
| ID | Affected | Fix |
|---|---|---|
| GO-2026-4866 | crypto/x509 — case-sensitive excludedSubtrees name constraints (auth bypass) | go1.26.2 |
| GO-2026-4870 | crypto/tls — unauthenticated TLS 1.3 KeyUpdate record (DoS) | go1.26.2 |
| GO-2026-4946 | crypto/x509 — inefficient policy validation | go1.26.2 |
| GO-2026-4947 | crypto/x509 — unexpected work during chain building | go1.26.2 |
Run: https://github.com/petry-projects/broodly/actions/runs/24116426580
Cause
go.mod declares go 1.26.1. govulncheck correctly flags every transitive use of the affected stdlib symbols. This was already failing on main before #93 (the workflow centralization PR) — the new reusable just surfaces the same finding the same way as the old inline workflow.
Fix
go mod edit -go=1.26.2
go mod tidy
govulncheck ./...
Activity
fix(api): bump Go toolchain to 1.26.2 for stdlib CVE fixes
fix(api): bump Go toolchain to 1.26.2 for stdlib CVE fixes (#96)