From ed9cdb48474592888bbc8a6588e418e6533fe456 Mon Sep 17 00:00:00 2001 From: Sacha Al Himdani Date: Thu, 9 Jul 2026 11:13:32 +0200 Subject: [PATCH] Update Go to 1.26.5 to fix stdlib CVEs Bump the Go toolchain from 1.26.4 to 1.26.5 to address CVE-2026-42505 (ECH handshake de-anonymization) and CVE-2026-39822 (os.Root symlink following on Unix). Signed-off-by: Sacha Al Himdani --- .github/actions/setup/action.yaml | 2 +- contrib/lima/provision.sh | 2 +- go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/actions/setup/action.yaml b/.github/actions/setup/action.yaml index 0dba0347b..66b98e58a 100644 --- a/.github/actions/setup/action.yaml +++ b/.github/actions/setup/action.yaml @@ -15,7 +15,7 @@ runs: - if: inputs.go == 'true' uses: "actions/setup-go@v6" with: - go-version: "1.26.4" + go-version: "1.26.5" cache: true - if: inputs.go == 'true' shell: bash diff --git a/contrib/lima/provision.sh b/contrib/lima/provision.sh index 132b3b882..65ab23623 100755 --- a/contrib/lima/provision.sh +++ b/contrib/lima/provision.sh @@ -11,7 +11,7 @@ export LIMA_CIDATA_USER export DEBIAN_FRONTEND=noninteractive -GO_VERSION="1.26.4" +GO_VERSION="1.26.5" NODE_MAJOR=24 NPM_VERSION="11.8.0" diff --git a/go.mod b/go.mod index c40ba02bc..4a0fba16d 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module go.probo.inc/probo -go 1.26.4 +go 1.26.5 require ( codeberg.org/miekg/dns v0.6.83