From 4c9b636393904d5ead21f083bd7658e2c1a7e56c Mon Sep 17 00:00:00 2001 From: kt Date: Tue, 20 Oct 2026 12:00:48 -0700 Subject: [PATCH] v1.3.5: build with Go 1.26.9 past three stdlib CVEs, check the Go we ship with govulncheck, changelog The binary scan is red on main and on the 1.3.4 release for three high severity bugs in Go 1.26.6's HTTP and TLS code (CVE-2026-78667, CVE-2026-78669, CVE-2026-97031), all fixed in 1.26.9. .go-version and go.mod move to 1.26.9. govulncheck never saw them because the action defaults go-version-input to the latest Go, which overrides .go-version, so it checked 1.27.3 rather than what we build with. Blanking it makes the action use .go-version, and changes to that file now trigger the check. --- .github/workflows/pr-govulncheck.yaml | 2 ++ .go-version | 2 +- CHANGELOG.md | 4 ++++ go.mod | 2 +- 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-govulncheck.yaml b/.github/workflows/pr-govulncheck.yaml index f85e037..9f04e3c 100644 --- a/.github/workflows/pr-govulncheck.yaml +++ b/.github/workflows/pr-govulncheck.yaml @@ -10,6 +10,7 @@ on: - 'go.mod' - 'go.sum' - 'vendor/**' + - '.go-version' - '.github/workflows/pr-govulncheck.yaml' schedule: - cron: '17 4 * * 1' # weekly, so new CVEs against unchanged code still get flagged @@ -23,4 +24,5 @@ jobs: steps: - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0 with: + go-version-input: '' # the action defaults this to the latest Go, which overrides the file and hides bugs in the Go we ship go-version-file: ./.go-version diff --git a/.go-version b/.go-version index f250c8f..3cd33cd 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.26.6 +1.26.9 diff --git a/CHANGELOG.md b/CHANGELOG.md index bc7839c..d9c5e45 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ +## v1.3.5 (2026-10-20) + +- build with Go 1.26.9 for its fixes to the standard library's HTTP and TLS code, mostly ways a misbehaving connection could stall or crash the program (CVE-2026-78667, CVE-2026-78669, CVE-2026-97031 and others); govulncheck finds tctest reaches several of them, and the binary now scans clean ([#152](https://github.com/katbyte/tctest/pull/152)) + ## v1.3.4 (2026-09-22) - bump golang.org/x/text to v0.42.0 for CVE-2026-56852, a hang on invalid UTF-8 input; tctest never calls the affected code, but the binary now scans clean ([#148](https://github.com/katbyte/tctest/pull/148)) diff --git a/go.mod b/go.mod index 4b60f38..2939233 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/katbyte/tctest -go 1.26.6 +go 1.26.9 require ( github.com/google/go-github/v89 v89.0.0