From 88dbbe5eb7cd16b1839a7d5f714b496e48398654 Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:34:00 +0200
Subject: [PATCH] ci: build on Go 1.26.9 so govulncheck stops failing on six
 net/http and net/textproto advisories

go1.26.8 has six standard-library advisories our code reaches (GO-2026-6608 and
GO-2026-6610 to 6617), all fixed in go1.26.9. The govulncheck gate now fails every
pull request. Bump the exact pin in all four workflows that set it; the security
notes listed three and missed catalog-drift.yml.
---
 .github/workflows/catalog-drift.yml   | 2 +-
 .github/workflows/ci.yml              | 4 ++--
 .github/workflows/desktop-release.yml | 2 +-
 docs/SECURITY-NOTES.md                | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/catalog-drift.yml b/.github/workflows/catalog-drift.yml
index 07332dc..555a501 100644
--- a/.github/workflows/catalog-drift.yml
+++ b/.github/workflows/catalog-drift.yml
@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
 
       # The ref goes through the environment rather than straight into the run
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a139213..4830862 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
 
       - name: Build
@@ -138,7 +138,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 0466914..92c6079 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: true
 
       - uses: actions/setup-node@v7
diff --git a/docs/SECURITY-NOTES.md b/docs/SECURITY-NOTES.md
index 5b92bc8..a72c820 100644
--- a/docs/SECURITY-NOTES.md
+++ b/docs/SECURITY-NOTES.md
@@ -7,7 +7,7 @@ present in the dependency tree. The job is a hard gate: a finding our code can r
 
 ## Go standard library
 
-The release and CI workflows pin an exact toolchain, `go-version: '1.26.8'`, so a release built today and one
+The release and CI workflows pin an exact toolchain, `go-version: '1.26.9'`, so a release built today and one
 rebuilt next month use the same compiler and standard library. The cost of an exact pin is that Go security
 releases do not arrive on their own: the workflows sat on `'1.26.5'` while go1.26.6 fixed five advisories our
 code actually calls (`GO-2026-6218` net/url, `GO-2026-6090` crypto/tls, `GO-2026-6089` and `GO-2026-5026`
@@ -15,7 +15,7 @@ net/http, `GO-2026-5972` encoding/asn1), and those shipped in release binaries u
 
 The `govulncheck` gate is what keeps the pin honest. It runs against the pinned toolchain, so a stdlib advisory
 our code can reach fails CI on the next pull request. When it does, or when a Go security release ships, bump
-the pin in all three places (`ci.yml` twice, `desktop-release.yml` once) to the latest 1.26.x and let the gate
+the pin in all four places (`ci.yml` twice, `desktop-release.yml` and `catalog-drift.yml` once each) to the latest 1.26.x and let the gate
 confirm it.
 
 If you build locally with an older toolchain you will see those findings. Update your Go toolchain.