From 33a2bbe281ee13803eefda98fc6549701e505229 Mon Sep 17 00:00:00 2001 From: Joshua Temple Date: Wed, 8 Jul 2026 12:33:53 -0400 Subject: [PATCH] chore(security): bump the Go toolchain to 1.26.5 for GO-2026-5856 Go 1.26.4's crypto/tls carries GO-2026-5856, an Encrypted Client Hello privacy leak, which the release validation gate's vulnerability scan flags and which blocks the release pipeline. Go 1.26.5 fixes it. Bump the toolchain directive in go.mod and e2e/go.mod; the go language directive is unchanged, and every CI job reads the version from go.mod via go-version-file, so the bump propagates without further edits. govulncheck is clean on 1.26.5. Signed-off-by: Joshua Temple --- e2e/go.mod | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/e2e/go.mod b/e2e/go.mod index d19d354a..05bccf84 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -2,7 +2,7 @@ module github.com/stablekernel/cascade/e2e go 1.25.0 -toolchain go1.26.4 +toolchain go1.26.5 replace github.com/stablekernel/cascade => ../ diff --git a/go.mod b/go.mod index 5d97c2bf..eafe2a0c 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/stablekernel/cascade go 1.25 -toolchain go1.26.4 +toolchain go1.26.5 require ( github.com/pmezard/go-difflib v1.0.0