Skip to content

chore: bump Go toolchain to 1.26.6 to resolve govulncheck failures - #45

Draft
juicycleff with Copilot wants to merge 2 commits into
mainfrom
copilot/fix-authsome-copilot-issue
Draft

chore: bump Go toolchain to 1.26.6 to resolve govulncheck failures#45
juicycleff with Copilot wants to merge 2 commits into
mainfrom
copilot/fix-authsome-copilot-issue

Conversation

Copilot AI commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

govulncheck CI was failing due to multiple standard library vulnerabilities present in Go 1.26.5, all fixed in 1.26.6:

CVE Package Description
GO-2026-6218 net/url Quadratic complexity in resolvePath
GO-2026-6091 html/template JS regexp context tracking fix
GO-2026-6090 crypto/tls Post-handshake message limit
GO-2026-6089 net/http ReadHeaderTimeout not applied on HTTP/2 check
GO-2026-6088 encoding/xml Missing recursion depth guard in decode

Changes

  • go.mod: Add toolchain go1.26.6 directive — pins the toolchain to the patched release while keeping the minimum module compatibility requirement at go 1.26.0
go 1.26.0

toolchain go1.26.6

Co-authored-by: juicycleff <11243590+juicycleff@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix issue with Copilot integration chore: bump Go toolchain to 1.26.6 to resolve govulncheck failures Aug 13, 2026
Copilot AI requested a review from juicycleff August 13, 2026 22:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants