ci: govulncheck gate for the backend, and patch what it found

.github/workflows/backend-vulncheck.yml

@@ -0,0 +1,93 @@
+name: Backend Vulncheck
+
+# The backend ships a binary to users: release-traceway.yml builds the
+# traceway-runner artifacts from backend/go.mod, and that binary runs on user
+# infrastructure with an outbound HTTPS long-poll as its main loop.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "backend/**"
+      # backend/go.mod carries `replace ... /cli => ../cli`, so cli source is
+      # compiled into this scan and a cli-only change can alter the result.
+      - "cli/**"
+      - ".github/workflows/backend-vulncheck.yml"
+  pull_request:
+    paths:
+      - "backend/**"
+      - "cli/**"
+      - ".github/workflows/backend-vulncheck.yml"
+  # A CVE lands in the database without anyone pushing a commit, and both
+  # triggers above are path-filtered. Off-the-hour to miss GitHub's
+  # on-the-hour scheduler backlog.
+  schedule:
+    - cron: "41 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  # One job per shipped storage backend, because the tags change which drivers
+  # compile in: `go list -deps ./cmd/traceway` returns 0 ClickHouse packages by
+  # default and 11 under transactional_pg,telemetry_ch. Rows map to
+  # Dockerfile.sqlite / Dockerfile.duckdb+.browser / Dockerfile+.minimal; see
+  # docs/pages/learn/build-tags.mdx.
+  #
+  # Storage axis only. The orthogonal `oxc` symbolicator tag needs
+  # scripts/build-oxc-shim.sh to compile, and only linux/amd64 is scanned
+  # though release also cross-compiles the runner for darwin and windows --
+  # both are follow-ups.
+  vulncheck:
+    name: vulncheck (${{ matrix.name }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      # Which backend a CVE reaches through is the question this job answers.
+      fail-fast: false
+      matrix:
+        include:
+          - name: default (dual SQLite)
+            tags: ""
+            cgo: "0"
+          - name: telemetry_duckdb
+            tags: telemetry_duckdb
+            cgo: "1"
+          - name: transactional_pg telemetry_ch
+            tags: transactional_pg,telemetry_ch
+            cgo: "0"
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # setup-go@v5 reads only the `go` line and never sets GOTOOLCHAIN, so it
+      # installs the 1.26.2 floor and the go command then switches to the
+      # `toolchain` directive -- the same path release-traceway.yml builds the
+      # runner through. The Docker images are not covered by that: the official
+      # golang bases set GOTOOLCHAIN=local, so they build with whatever the
+      # floating golang:1.26-* tag ships, which is >= what is scanned here.
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache-dependency-path: backend/go.sum
+
+      # Pinned so a tool release cannot redden an unrelated PR. Costs no
+      # freshness: the advisory database is fetched at run time, so the
+      # schedule keeps this current, not the binary version.
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
+
+      # No -test: the gate is about what ships.
+      - name: Vulncheck
+        env:
+          TAGS: ${{ matrix.tags }}
+          CGO_ENABLED: ${{ matrix.cgo }}
+        run: govulncheck -tags "$TAGS" ./...

CLAUDE.md

@@ -28,6 +28,7 @@ Traceway is an error tracking and monitoring platform consisting of:
 | Frontend | `npm run build` | Production build |
 | Frontend | `npm run check` | TypeScript checking |
 | Backend | `cd backend && go run ./cmd/traceway` | API server (port 8082) |
+| Backend | `cd backend && govulncheck ./...` | Vulnerability scan (default tags only); CI also scans the other storage build-tag combos (`.github/workflows/backend-vulncheck.yml`) |
 | CLI | `cd cli && just build` | Builds `bin/traceway` |
 | CLI | `cd cli && just test` | Runs unit tests |
 | CLI | `cd cli && just check` | Lint + test + vulncheck (pre-commit gate) |
@@ -37,7 +38,7 @@ Set `JWT_SECRET` (min 32 characters) before running the backend — it is the on
 
 ### Tech Stack
 - **Frontend**: SvelteKit 2.49, Svelte 5.45, Tailwind CSS v4, shadcn-svelte, Vite 7
-- **Backend**: Go 1.25, Gin 1.11, ClickHouse, PostgreSQL
+- **Backend**: Go 1.26, Gin 1.11, ClickHouse, PostgreSQL (in `backend/go.mod` the `go` line is the floor importers inherit and the `toolchain` directive is what builds it — keep the two distinct)
 - **CLI**: Go 1.26, Cobra 1.10, separate Go module (`github.com/tracewayapp/traceway/cli`); flake.nix dev shell, justfile entrypoints
 - **Client SDK**: Go 1.25, Gin middleware support
 

README.md

@@ -225,7 +225,7 @@ A full-stack framework has two halves and two Traceway projects. Next.js and Rem
 
 | Component     | Technology                                            |
 | ------------- | ----------------------------------------------------- |
-| Backend       | Go 1.25, Gin                                          |
+| Backend       | Go 1.26, Gin                                          |
 | Frontend      | SvelteKit 2, Svelte 5, Tailwind CSS v4                |
 | Telemetry DB  | ClickHouse (standalone), SQLite or DuckDB (embedded)  |
 | Relational DB | PostgreSQL (standalone) or SQLite (embedded)          |

backend/go.mod

@@ -2,12 +2,14 @@ module github.com/tracewayapp/traceway/backend
 
 go 1.26.2
 
+toolchain go1.26.6
+
 require (
 	cloud.google.com/go/storage v1.56.0
-	github.com/aws/aws-sdk-go-v2 v1.41.1
+	github.com/aws/aws-sdk-go-v2 v1.41.5
 	github.com/aws/aws-sdk-go-v2/config v1.32.7
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.7
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3
 	github.com/coreos/go-systemd/v22 v22.6.0
 	github.com/dop251/goja v0.0.0-20260607120635-348e6bea910d
 	github.com/duckdb/duckdb-go/v2 v2.10504.0
@@ -44,7 +46,7 @@ require (
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
 	github.com/apache/arrow-go/v18 v18.5.1 // indirect
@@ -101,7 +103,7 @@ require (
 	go.opentelemetry.io/collector/pdata/testdata v0.154.0 // indirect
 	go.opentelemetry.io/collector/pipeline v1.60.0 // indirect
 	go.opentelemetry.io/collector/processor/xprocessor v0.154.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/host v0.69.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
@@ -111,14 +113,14 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20260112195511-716be5621a96 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa // indirect
+	golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.247.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
-	google.golang.org/grpc v1.81.1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 // indirect
 	modernc.org/libc v1.41.0 // indirect
@@ -131,21 +133,21 @@ require (
 require (
 	github.com/ClickHouse/ch-go v0.69.0 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
-	github.com/aws/smithy-go v1.24.0
+	github.com/aws/smithy-go v1.24.2
 	github.com/bytedance/sonic v1.14.0 // indirect
 	github.com/bytedance/sonic/loader v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -169,22 +171,21 @@ require (
 	github.com/paulmach/orb v0.12.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pierrec/lz4/v4 v4.1.25 // indirect
-	github.com/quic-go/qpack v0.5.1 // indirect
-	github.com/quic-go/quic-go v0.54.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.59.1 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.0 // indirect
 	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0
-	go.uber.org/mock v0.5.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/protobuf v1.36.11
 )
 
@@ -194,9 +195,9 @@ require (
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1
-	golang.org/x/crypto v0.51.0
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/crypto v0.53.0
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
 )
 
 // Local development only. `replace` is ignored by anything that imports this