From 7e55b8c477f1fec29d3de8533a9c2bdb7625d801 Mon Sep 17 00:00:00 2001 From: Erick Shaffer Date: Wed, 14 Oct 2026 05:50:19 -0600 Subject: [PATCH] fix: build with Go 1.26.9 and x/net v0.60.0 to clear new vulnerabilities govulncheck reports seven reachable net/http, crypto/tls, mime/multipart, and x/net vulnerabilities fixed only in Go 1.26.9 and x/net v0.60.0. Raise golangci-lint to v2.14.0, which supports Go 1.26. --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/release.yml | 2 +- docs/bug-fixes.md | 17 +++++++++++++++ go.mod | 10 ++++----- go.sum | 24 +++++++++++----------- internal/domain/categorizer/categorizer.go | 4 ++-- 6 files changed, 41 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 56accd1..9576851 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,7 +7,7 @@ on: branches: [ main, develop ] env: - GO_VERSION: '1.25.13' + GO_VERSION: '1.26.9' jobs: lint: @@ -26,7 +26,7 @@ jobs: - name: Run golangci-lint uses: golangci/golangci-lint-action@v9 with: - version: v2.4.0 + version: v2.14.0 args: --timeout=5m govulncheck: @@ -72,7 +72,7 @@ jobs: needs: [module-integrity] strategy: matrix: - go-version: ['1.25.13'] + go-version: ['1.26.9'] steps: - name: Checkout code uses: actions/checkout@v7 @@ -92,7 +92,7 @@ jobs: go tool cover -func=coverage.txt - name: Upload coverage reports to Codecov - if: matrix.go-version == '1.25.13' && (github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]') + if: matrix.go-version == '1.26.9' && (github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]') uses: codecov/codecov-action@v7 with: token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5c81b3a..4a4cc68 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,7 +10,7 @@ permissions: packages: write env: - GO_VERSION: '1.25.13' + GO_VERSION: '1.26.9' jobs: test: diff --git a/docs/bug-fixes.md b/docs/bug-fixes.md index 195a0ed..d92941b 100644 --- a/docs/bug-fixes.md +++ b/docs/bug-fixes.md @@ -12,6 +12,23 @@ Each bug fix entry should include: ## Bug Fixes +### 2026-10-14: CI and release builds used a Go release with unpatched net/http, crypto/tls, and x/net vulnerabilities + +**Description:** +The pull-request vulnerability scan failed with seven reachable vulnerabilities (GO-2026-6607, -6608, -6610, -6611, -6612, -6613, -6617) in `net/http`, `mime/multipart`, `crypto/tls`, and `golang.org/x/net v0.58.0`. They were published after main's last green CI run. Go 1.25 received no patch; the fixes are in Go 1.26.9 and `golang.org/x/net v0.60.0`. + +**Fix Applied:** +- Raised the module, CI, and release workflow toolchain to Go 1.26.9. +- Upgraded `golang.org/x/net` to `v0.60.0`. +- Raised CI's golangci-lint from v2.4.0, which was built with Go 1.25 and refuses to lint a Go 1.26 module, to v2.14.0. +- Applied its two new staticcheck QF1012 suggestions in the categorizer prompt builder. + +**Verification:** +- With Go 1.26.9, `govulncheck ./...` reports no vulnerabilities. +- `go test -race ./...` passes and golangci-lint v2.14.0 reports 0 issues. + +**Commit:** Included in the pull request for this fix. + ### 2026-10-03: Amazon multi-category splits added allocated tax twice **Description:** diff --git a/go.mod b/go.mod index a278894..e476862 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/eshaffer321/itemize -go 1.25.13 +go 1.26.9 require ( github.com/PuerkitoBio/goquery v1.13.0 @@ -33,10 +33,10 @@ require ( github.com/stretchr/objx v0.5.3 // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/net v0.58.0 // indirect - golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sync v0.23.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/text v0.42.0 // indirect modernc.org/libc v1.75.6 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.12.1 // indirect diff --git a/go.sum b/go.sum index 0a8a353..ae051d9 100644 --- a/go.sum +++ b/go.sum @@ -70,18 +70,18 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= -golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= -golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= diff --git a/internal/domain/categorizer/categorizer.go b/internal/domain/categorizer/categorizer.go index a9f5492..d36250e 100644 --- a/internal/domain/categorizer/categorizer.go +++ b/internal/domain/categorizer/categorizer.go @@ -294,12 +294,12 @@ func isReasoningModel(model string) bool { func (c *Categorizer) buildPrompt(items []Item, categories []Category) string { var itemsList strings.Builder for i, item := range items { - itemsList.WriteString(fmt.Sprintf("%d. %s - $%.2f\n", i+1, item.Name, item.Price)) + fmt.Fprintf(&itemsList, "%d. %s - $%.2f\n", i+1, item.Name, item.Price) } var categoriesList strings.Builder for _, cat := range categories { - categoriesList.WriteString(fmt.Sprintf("- %s (ID: %s)\n", cat.Name, cat.ID)) + fmt.Fprintf(&categoriesList, "- %s (ID: %s)\n", cat.Name, cat.ID) } prompt := fmt.Sprintf(`Please categorize the following items into the most appropriate categories.