Repository navigation
fix: pin Go toolchain to 1.26.6 for stdlib security fixes (#18) - #19
Merged
antoinetoussaint-byte merged 2 commits intoAug 20, 2026
Conversation
Adds a toolchain directive so builds and releases use the 1.26.6 standard library, resolving the HIGH stdlib advisories. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The `toolchain go1.26.6` directive added for the stdlib security fix makes go.mod pin a toolchain newer than the `go` line. setup-go then installs the older Go and GOTOOLCHAIN downloads the 1.26.6 toolchain into the module cache; setup-go's cache tar collides on those read-only toolchain files (tar: .../cgo: File exists), which would fail every CI run. Skipping the cache is the same mitigation the shared release workflow already applies for this pattern. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #18.
Summary
go.modgo 1.26directive left the build's stdlib patch version unpinned, so builds could link an older 1.26.x standard library flagged by 4 HIGH advisories (GO-2026-5026, GO-2026-5972, GO-2026-6090, GO-2026-6218). Atoolchain go1.26.6directive forces every build/scan (CI, GoReleaser, andcodefly publish's govulncheck viaGOTOOLCHAIN=auto) onto the patched 1.26.6 stdlib.toolchainnewer than thegoline, which triggers a knownsetup-gocache collision on the read-only toolchain files (tar: .../cgo: File exists).ci.ymlused default caching and would fail every run; it now setscache: false, mirroring the mitigation already present in the shared release workflow.Test plan
go build ./...go vet ./...go test ./...ci.ymlvalidated as well-formed YAMLcache: falsefix on a real GitHub Actions runner — not reproducible locally)