From 5887153bcaad85a9ca177fb64c76f28c02666c95 Mon Sep 17 00:00:00 2001 From: Kush Date: Fri, 14 Aug 2026 10:33:23 -0400 Subject: [PATCH] chore: bump Go to 1.26.6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck reports five standard-library vulnerabilities against 1.26.5, all fixed in 1.26.6: GO-2026-6088 encoding/xml recursion depth guard during decode GO-2026-5972 encoding/asn1 maximum recursion depth GO-2026-5026 net/http ASCII-only Punycode labels in x/net/idna (plus two crypto/tls traces reported against the same toolchain) Reached through internal/api/xml.go, internal/api/client.go, internal/sip/service.go, internal/cmdutil/numbertype.go, and internal/version/check.go — so they are called paths, not merely present. Verified locally on 1.26.6: build, full test suite, and vet all pass, and govulncheck goes from 5 affected vulnerabilities to 0. These CVEs landed after main last ran CI on 2026-08-11, so main is red on the security job independently of any open PR. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 3ea3142..edb6485 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/Bandwidth/cli -go 1.26.5 +go 1.26.6 require ( github.com/briandowns/spinner v1.23.2