chore: bump Go toolchain to 1.26.5 for GO-2026-5856 - #683
Merged
Conversation
govulncheck fails on every open PR because GO-2026-5856 (crypto/tls Encrypted Client Hello privacy leak) is reachable from sanitizer.SanitizeXML via io.ReadAll and is present in go1.26.4. Fixed in go1.26.5, so bump the go.mod toolchain and the mise pin. The newer toolchain's modernize pass also flags the errors.As call in internal/config; migrate it to errors.AsType with a targeted errcheck suppression (check-blank flags the intentionally discarded match value). Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
dosubot
Bot
added
size:XS
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
Summary by CodeRabbit
WalkthroughThe change updates Go toolchain pins from 1.26.4 to 1.26.5 and changes Viper missing-config detection to use ChangesConfiguration and toolchain updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
✨ Simplify code
Comment |
Contributor
Merge Protections🔴 1 of 4 protections blocking · waiting on 🙋 you
🔴 🚦 Auto-queueWaiting for
This rule is failing.When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.
Show 3 satisfied protections🟢 Enforce conventional commitRequire conventional commit format per https://www.conventionalcommits.org/en/v1.0.0/. Skipped for dependabot and dosubot.
🟢 Full CI must passAll CI checks must pass. Activates for non-bot authors, or dependabot when files exist outside .github/workflows/.
🟢 Do not merge outdated PRsMake sure PRs are within 10 commits of the base branch before merging
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s Go toolchain to go1.26.5 to address GO-2026-5856 (a crypto/tls ECH privacy leak) that is currently causing govulncheck failures in the Security workflow, and aligns local tool pins accordingly.
Changes:
- Bump the Go toolchain from
go1.26.4→go1.26.5ingo.mod. - Update the
miseGo pin and lockfile to match1.26.5. - Modernize a config-file-not-found detection branch to use Go 1.26’s
errors.AsType.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
go.mod |
Updates the module toolchain directive to go1.26.5 to pick up the stdlib security fix. |
mise.toml |
Pins go = "1.26.5" for consistent local/dev tooling. |
mise.lock |
Updates Go download URLs and checksums for all supported platforms to 1.26.5. |
internal/config/config.go |
Switches errors.As usage to errors.AsType for typed matching under the new toolchain. |
Member
Author
|
@Mergifyio queue |
Contributor
Merge Queue Status
Waiting for
All conditions
|
![coderabbitai[bot]](https://webproxy.poorya-velaei-d67.workers.dev/https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
govulncheck is failing the Security workflow on every open PR (#682, #681, #680, #655) because GO-2026-5856 — a crypto/tls Encrypted Client Hello privacy leak in the Go standard library — is reachable from
sanitizer.SanitizeXMLviaio.ReadAlland is present in go1.26.4. The fix shipped in go1.26.5.Changes
go.modtoolchain from go1.26.4 to go1.26.5mise.tomlGo pin (andmise.lock) to matcherrors.Ascall ininternal/config/config.goto Go 1.26'serrors.AsType, flagged by the modernize pass under the new toolchain. The intentionally discarded match value carries a targeted, explained//nolint:errcheck(the repo enablescheck-blank); no linter configuration was changed.Test plan
just ci-checkpasses locally (lint, modernize, tests, race detector)govulncheck ./...reports no vulnerabilities under go1.26.5AI Disclosure
Used Claude Code (Fable 5) to diagnose the govulncheck failure and draft this change. All changes reviewed and verified locally per AI_POLICY.md.