chore: bump Go to 1.26.6 (5 stdlib CVEs) - #28
Merged
Conversation
govulncheck reports five standard-library vulnerabilities against 1.26.5, all fixed in 1.26.6: GO-2026-6088 encoding/xml recursion depth guard during decode GO-2026-5972 encoding/asn1 maximum recursion depth GO-2026-5026 net/http ASCII-only Punycode labels in x/net/idna (plus two crypto/tls traces reported against the same toolchain) Reached through internal/api/xml.go, internal/api/client.go, internal/sip/service.go, internal/cmdutil/numbertype.go, and internal/version/check.go — so they are called paths, not merely present. Verified locally on 1.26.6: build, full test suite, and vet all pass, and govulncheck goes from 5 affected vulnerabilities to 0. These CVEs landed after main last ran CI on 2026-08-11, so main is red on the security job independently of any open PR.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
achandras
approved these changes
Aug 14, 2026
mkeathley-bw
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BLUF
govulncheckreports five Go standard-library vulnerabilities against 1.26.5, all fixed in 1.26.6. One-line change togo.mod. Verified locally: 5 affected → 0.Why now
These CVEs landed after main last ran CI on 2026-08-11, so main is red on the
securityjob independently of any open PR — it just hasn't re-run. PR #27 was the first thing to run CI since and surfaced it.What's affected
encoding/xml— recursion depth guard during decodeencoding/asn1— maximum recursion depthnet/http— ASCII-only Punycode labels inx/net/idnaPlus two
crypto/tlstraces against the same toolchain.These are called paths, not merely present in the binary — govulncheck traced them through
internal/api/xml.go,internal/api/client.go,internal/sip/service.go,internal/cmdutil/numbertype.go, andinternal/version/check.go.Verification
Run locally under
GOTOOLCHAIN=go1.26.6:Baseline on 1.26.5 for comparison:
affected by 5 vulnerabilities.CI picks the toolchain up automatically — every job uses
go-version-file: go.mod.Notes
Follows the precedent of #19 (
chore: bump Go to 1.26.5, GO-2026-5856).Two related gaps this PR does not address:
ci.ymltriggers only on push-to-main and PRs, so a new CVE stays invisible until someone opens a PR. That's why this surfaced three days late and on an unrelated PR.ci.yml:58installsgovulncheck@latest, so the scanner can change between runs — the security job can start failing with no repo change.A follow-up PR adds a scheduled workflow that opens a bump PR automatically when a newer Go patch is released.