From a5b4f6e67eca32e1ef1e901b3cf036d7db436d0f Mon Sep 17 00:00:00 2001 From: Chris Stockton Date: Wed, 11 Nov 2026 13:12:22 -0700 Subject: [PATCH] fix(deps): bump go to 1.27.4 to fix net/http server crash Bumps Go to 1.27.4 to fix GO-2026-6859 (an HTTP/1 server crash caused by a race on headers in `MaxBytesReader`), which govulncheck flagged through the API's HTTP handlers. --- Dockerfile | 2 +- Dockerfile.dev | 2 +- go.mod | 2 +- internal/forks/godotenv/go.mod | 2 +- tools/go.mod | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 65a311e861..62041075f8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.27.3-alpine3.23 as build +FROM golang:1.27.4-alpine3.23 as build ENV GO111MODULE=on ENV CGO_ENABLED=0 ENV GOOS=linux diff --git a/Dockerfile.dev b/Dockerfile.dev index 1391d7c0de..4ede65a7c8 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,4 +1,4 @@ -FROM golang:1.27.3-alpine3.23 +FROM golang:1.27.4-alpine3.23 ENV GO111MODULE=on ENV CGO_ENABLED=0 ENV GOOS=linux diff --git a/go.mod b/go.mod index 7df9695ffe..b01958e436 100644 --- a/go.mod +++ b/go.mod @@ -191,7 +191,7 @@ require ( gopkg.in/h2non/gock.v1 v1.1.2 ) -go 1.27.3 +go 1.27.4 replace github.com/joho/godotenv => ./internal/forks/godotenv diff --git a/internal/forks/godotenv/go.mod b/internal/forks/godotenv/go.mod index 65ab59a43e..0ec8df8b8c 100644 --- a/internal/forks/godotenv/go.mod +++ b/internal/forks/godotenv/go.mod @@ -1,3 +1,3 @@ module github.com/joho/godotenv -go 1.27.3 +go 1.27.4 diff --git a/tools/go.mod b/tools/go.mod index d8943f1b1b..658840e447 100644 --- a/tools/go.mod +++ b/tools/go.mod @@ -1,6 +1,6 @@ module github.com/supabase/auth/tools -go 1.27.3 +go 1.27.4 tool ( github.com/securego/gosec/v2/cmd/gosec