build: bump Go to 1.26.7 - #33
Merged
Merged
Conversation
go1.26.5 carries standard-library advisories fixed in 1.26.6, which the vulnerability scan reports on pull requests, on pushes to main, and weekly. This stops at 1.26.7 rather than 1.27.0 because the pinned golangci-lint is built against Go 1.26 and refuses a 1.27 target. Releases adding go1.27 support exist upstream, but mise's minimum_release_age holds them back as a supply-chain guard, so the pinned toolchain cannot adopt them yet — and the mise pin and the golangci-lint-action version input in ci.yml are one atomic value, so moving only the CI half would trade a red report for undetected local/CI drift. Revisit Go 1.27 once that release-age window passes. Until then the toolchain currency report stays red: it compares each pin against the latest release rather than against the latest patch of the pinned minor. mise.toml, go.mod, and mise.lock move together because nothing in CI detects a mismatch between them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Moves the pinned Go toolchain from 1.26.5 to 1.26.7, clearing the standard-library advisories that have failed the vulnerability scan since the weekly run on 2026-08-17. All eight — four reachable from this code, four more reported at package or module level — are
stdlib@go1.26.5fixed ingo1.26.6, so the bump resolves the whole batch.just vulnnow reportsNo vulnerabilities found.How it works
Stopping at 1.26.7 rather than at 1.27.0, the current release, is deliberate. The pinned golangci-lint is built against Go 1.26 and refuses a 1.27 target; releases adding go1.27 support exist upstream, but mise's
minimum_release_ageguard holds them back, so the pinned toolchain cannot adopt one yet. Advancing only the CI half is not available — the mise pin and thegolangci-lint-actionversion:input are one atomic value with nothing detecting a mismatch between them, so it would trade a visible red report for silent local/CI drift. The Toolchain currency workflow therefore stays red until that window clears, since it compares each pin against the latest release rather than against the latest patch of the pinned minor.mise.lockwas refreshed withmise lockrather thanmise install, so every platform entry moved rather than only this machine's.No changelog entry is included. A pinned-toolchain bump is build tooling, which the changelog conventions exclude, and
SECURITY.mdrecords the red-scan-then-bump cycle as the expected response to a red scan rather than a notable event.Related to #32.