Repository navigation
Merged
Conversation
…ship with govulncheck, changelog The binary scan is red on main and on the 1.3.4 release for three high severity bugs in Go 1.26.6's HTTP and TLS code (CVE-2026-78667, CVE-2026-78669, CVE-2026-97031), all fixed in 1.26.9. .go-version and go.mod move to 1.26.9. govulncheck never saw them because the action defaults go-version-input to the latest Go, which overrides .go-version, so it checked 1.27.3 rather than what we build with. Blanking it makes the action use .go-version, and changes to that file now trigger the check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Build with Go 1.26.9, make govulncheck check the Go we actually build with, and write the changelog section for 1.3.5.
Why: the binary scan is red on main and on the 1.3.4 release. Go 1.26.6, which every build since 1.3.2 uses, has three high severity bugs in its HTTP and TLS code. The govulncheck check on PRs stayed green the whole time because it was quietly checking a newer Go than the one we ship.
Go 1.26.6 to 1.26.9. CVE-2026-78667, CVE-2026-78669 and CVE-2026-97031, mostly ways a misbehaving connection could stall or crash the program. Unlike the x/text bug in 1.3.4, govulncheck finds tctest reaches these: run against 1.26.6 it reports nine fixed in 1.26.9, through tctest's HTTP calls. A build on 1.26.9 scans clean at every severity, unfixed findings included.
govulncheck checked the wrong Go. The action defaults
go-version-inputtostable, and setup-go ignores the version file whenever a version is given, so the check ran on Go 1.27.3 and could never see a bug in the Go we build with. The log even says so: "Both go-version and go-version-file inputs are specified, only go-version will be used". Blanking the input makes it use.go-version, and a change to.go-versionnow triggers the check.with: + go-version-input: '' # the action defaults this to the latest Go, which overrides the file and hides bugs in the Go we ship go-version-file: ./.go-versionChangelog section for 1.3.5, for the Go bump. Dated today; adjust if the tag slips.
Things that are fine as they are. Tests (under the race detector), lint, depscheck, actionlint, yamllint, zizmor and typos pass on 1.26.9. The local scanner reports the same three findings as CI on a 1.26.6 build of main, so the clean 1.26.9 result is not the scanner missing them.
.tools/go.modstays atgo 1.26.6: it is the minimum for building the dev tools, which are not shipped. The release scan job only goes green once 1.3.5 is published; the release workflow reruns it.