From 3be697d408715a33bc879b7fe2e3583df9a671ee Mon Sep 17 00:00:00 2001 From: Alex Luong Date: Wed, 1 Jul 2026 15:11:48 +0700 Subject: [PATCH 1/2] fix(deps): bump Go toolchain to 1.26.4 to patch stdlib CVEs The v1.0.6 release binary is compiled with Go 1.26.0 stdlib, which a security scanner flags for 29 stdlib vulnerabilities (issue #979). Because GOTOOLCHAIN=auto honors the go.mod directive, bumping it to 1.26.4 forces the release build to compile against the patched stdlib. Fixes #979 Co-Authored-By: Claude Opus 4.8 (1M context) --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 9ea0e044f..d301134a8 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/hookdeck/outpost -go 1.26.0 +go 1.26.4 require ( cloud.google.com/go/pubsub v1.50.2 From 32ee57c44ce193bc0854efbf8461f7fbcd1379a8 Mon Sep 17 00:00:00 2001 From: Alex Luong Date: Wed, 1 Jul 2026 15:12:00 +0700 Subject: [PATCH 2/2] ci: install Go 1.26.4 directly in release and unit-test workflows Match the go.mod directive so CI builds/tests on the patched toolchain instead of relying on GOTOOLCHAIN auto-download. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 2 +- .github/workflows/unit-tests.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 856cee93e..4d198fad5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,7 +38,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: 1.23.0 + go-version: 1.26.4 - name: Run GoReleaser uses: goreleaser/goreleaser-action@v4 with: diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 9cbabaf40..b5e2dd5c9 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -16,7 +16,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: '1.23.0' + go-version: '1.26.4' - name: Install gotestsum run: go install gotest.tools/gotestsum@latest