Skip to content

chore: upgrade to Go 1.26.2 with toolchain directive#298

Merged
sebrandon1 merged 1 commit intomainfrom
chore/go-1.26.2
Apr 8, 2026
Merged

chore: upgrade to Go 1.26.2 with toolchain directive#298
sebrandon1 merged 1 commit intomainfrom
chore/go-1.26.2

Conversation

@sebrandon1
Copy link
Copy Markdown
Member

@sebrandon1 sebrandon1 commented Apr 8, 2026

Summary

Set go 1.26 as the minimum language version with toolchain go1.26.2 in go.mod for improved compatibility and security.

Security Fixes

Go 1.26.2 announcement — 10 CVEs fixed:

CVE Package Issue
CVE-2026-27140 cmd/go Code smuggling via crafted SWIG file names
CVE-2026-27143 cmd/compile Invalid arithmetic over loop induction variables
CVE-2026-27144 cmd/compile Incorrect pointer unwrapping in memory moves
CVE-2026-32280 crypto/x509 DoS via unlimited chain building with many intermediates
CVE-2026-32281 crypto/x509 DoS via inefficient policy mapping validation
CVE-2026-32282 os (unix) Symlink traversal in Root.Chmod on Linux
CVE-2026-32283 crypto/tls TLS 1.3 deadlock from multiple key update messages
CVE-2026-32288 archive/tar Unbounded memory allocation from sparse map entries
CVE-2026-32289 html/template XSS via incorrect escaping in JS template literals
CVE-2026-33810 crypto/x509 DNS constraint bypass with case-sensitive wildcards

Related PRs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant