Skip to content

fix(security): remediate CVE vulnerabilities in Go stdlib - #137

Closed
ulucinar wants to merge 1 commit into
mainfrom
fix/cve-remediation-main-20260825-124445
Closed

ulucinar wants to merge 1 commit into
mainfrom
fix/cve-remediation-main-20260825-124445

Conversation

@ulucinar

Copy link
Copy Markdown
Collaborator

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
GO-2026-5026 High stdlib go1.26.6
GO-2026-5972 High stdlib go1.26.6
GO-2026-6088 High stdlib go1.26.6
GO-2026-6089 High stdlib go1.26.6
GO-2026-5942 High stdlib go1.26.6
GO-2026-6090 High stdlib go1.26.6
GO-2026-6218 Medium stdlib go1.26.6
GO-2026-6091 Medium stdlib go1.26.6

Changes Made

  • Updated go directive in go.mod from 1.26.5 to 1.26.6
  • Ran go mod tidy to update go.sum
  • Updated GO_VERSION in .github/workflows/ci.yml to 1.26.6

References

Verification

  • Rescanned with `cve-scan` skill after fixes
  • All listed vulnerabilities resolved

- Update Go version to 1.26.6 (fixes GO-2026-5026, GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-5942, GO-2026-6090, GO-2026-6218, GO-2026-6091)
- Update CI workflow to use Go 1.26.6

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
@ulucinar
ulucinar requested a review from phisco as a code owner August 25, 2026 12:45
@ulucinar ulucinar closed this Sep 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant