build(deps): move the Go toolchain to 1.26.7 - #124
Merged
Conversation
Two standard-library advisories published since the last pin are reachable from finch's own code — a post-handshake message limit in crypto/tls and a recursion depth limit in encoding/asn1 — so the merge-blocking govulncheck gate now fails every pull request that touches Go, not only the one that surfaced it. Both have released fixes, so this is the ordinary remedy rather than a case for the ruleset bypass, which is reserved for an advisory with nowhere to go. The pin stays inside 1.26 because 1.27 is a fresh minor whose first patch has not shipped and whose linter pairing would have to move with it; that upgrade deserves its own change, where a regression is attributable to it. The pin lives in mise.toml and in both workflows, which CI asserts agree, so all three move together. golangci-lint stays put, still built against the same minor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AeowJi9gm6eE3YjoeSyM4A
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
The merge-blocking
govulncheckgate fails on every pull request that touches Go. Two standard-library advisories published since the pin last moved are reachable from finch's own code — a limit on post-handshake messages incrypto/tls(GO-2026-6090) and a maximum recursion depth inencoding/asn1(GO-2026-5972), both reached through the gRPC transport and the protobuf runtime. Both are fixed in go1.26.6; the pin was at 1.26.5.This moves the pin to 1.26.7 in
mise.tomland in both workflows, which CI asserts agree with each other.How it works
Two choices worth stating, since neither is visible in a four-line diff.
Why not the ruleset bypass.
.claude/rules/ci.mdreserves the bypass actor for an advisory with no released fix, and obliges filing an issue to record the exception when it is used. A fix exists here, so the ordinary remedy applies and there is no exception to record.Why not 1.27. Go 1.27 is released and current, which is precisely why 1.26 remains supported — Go keeps the two most recent minors, so this pin stays within one minor of current as
mise.tomlrequires, with no end-of-life pressure. Against moving now: 1.27.0 is a new minor with no patch release yet, andmise.tomlcouples golangci-lint to the Go pin ("bump both together"), so 1.27 would pull the linter from 2.12.2 to 2.13.x as well. That is a toolchain upgrade worth its own change, where a regression is attributable to the upgrade rather than to unblocking a gate.Verified on 1.26.7:
just vulnreports no vulnerabilities across all three modules, andjust testandjust lintpass.Issue references
Related to #101. That issue tracks the unreconciled duplication between
mise.tomland the workflows; this change is an instance of the cost it describes — one version edited in three places — and does not address it.Unblocks #115, #116, and #123, which fail on this same gate rather than on anything in their own diffs.