[don-petry]

Closes #95.

Adds toolchain go1.26.2 to apps/api/go.mod so the build pulls a Go release that includes the fixes for four standard-library vulnerabilities flagged by govulncheck on main:

ID	Affected	Fix
GO-2026-4866	crypto/x509 — case-sensitive excludedSubtrees name constraints (auth bypass)	go1.26.2
GO-2026-4870	crypto/tls — unauthenticated TLS 1.3 KeyUpdate record (DoS)	go1.26.2
GO-2026-4946	crypto/x509 — inefficient policy validation	go1.26.2
GO-2026-4947	crypto/x509 — unexpected work during chain building	go1.26.2

The go directive stays at 1.24 because no language features above that version are used; only the toolchain pin is bumped.

Test plan

• go mod tidy clean locally on go1.26.2
• go vet ./... clean
• CI on this branch — dependency-audit / govulncheck should pass

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated build toolchain configuration to ensure consistent compilation environment across deployments.

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 5 minutes and 8 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 8 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8807eb63-1554-4050-8fd3-56a331cc6458

📥 Commits

Reviewing files that changed from the base of the PR and between e9d4134 and 72497c6.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• apps/api/cmd/server/main.go

📝 Walkthrough

Walkthrough

Added a toolchain go1.26.2 directive to the Go module configuration file to enforce Go version 1.26.2 for builds, addressing four standard library security vulnerabilities. The go 1.24 directive remains unchanged.

Changes

Cohort / File(s)	Summary
Go Toolchain Configuration apps/api/go.mod	Added toolchain go1.26.2 directive to enforce Go 1.26.2, addressing four stdlib security vulnerabilities (GO-2026-4866, GO-2026-4870, GO-2026-4946, GO-2026-4947) in crypto/x509 and crypto/tls packages.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: bumping the Go toolchain to 1.26.2 to address stdlib CVE vulnerabilities, matching the changeset's addition of the toolchain directive.
Linked Issues check	✅ Passed	The PR fulfills the core objective from issue #95 by adding the toolchain directive to pin Go 1.26.2, addressing all four flagged stdlib vulnerabilities (GO-2026-4866, GO-2026-4870, GO-2026-4946, GO-2026-4947).
Out of Scope Changes check	✅ Passed	All changes are in scope: only the go.mod file was modified to add the toolchain directive, with no unrelated modifications present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bump-go-toolchain-1262

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates the API module’s Go toolchain selection to ensure builds and security scans use a patched Go standard library without changing the module’s declared language/version semantics.

Changes:

• Adds a toolchain go1.26.2 directive to apps/api/go.mod.
• Documents the specific stdlib vulnerability IDs motivating the toolchain pin while keeping go 1.24.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/api/go.mod`:
- Line 9: The repo's Go toolchain is pinned to "toolchain go1.26.2" in go.mod
but CI and container builds still use older Go (e.g., references to "go-version"
setup and "FROM golang:1.24" base images), causing a mismatch; update all CI
workflow "go-version" / setup-go entries and all Dockerfile "FROM golang:..."
base image tags to 1.26.2 (or read the version from go.mod) so the toolchain is
consistent across builds and images, and re-run the provided verification script
to confirm the three checks (go.mod toolchain, CI setup-go/go-version, and
Docker FROM lines) now report 1.26.2.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d670878f-148c-4bf1-ae47-17c6d501849a

📥 Commits

Reviewing files that changed from the base of the PR and between 4765926 and e9d4134.

📒 Files selected for processing (1)

• apps/api/go.mod

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud