From 15888565e3f237d5a855c13ab58ff968bb35ef44 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Wed, 21 Oct 2026 04:19:42 +0200 Subject: [PATCH] fix(ci): bump Go to 1.26.10 for GO-2026-6809 Pin Go 1.26.10 in go.mod/go.work, workflow defaults and docs so govulncheck no longer reports the crypto/x509 vulnerability fixed in 1.26.10. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/README.md | 2 +- .github/workflows/ci.yml | 4 ++-- CHANGELOG.md | 1 + CONTRIBUTING.md | 2 +- README.md | 2 +- ci_cd_sanity_tests/go.mod | 2 +- go.work | 2 +- pkg/go.mod | 2 +- providers/aws/go.mod | 2 +- providers/azure/go.mod | 2 +- providers/gcp/go.mod | 2 +- 11 files changed, 12 insertions(+), 11 deletions(-) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 6520a485..2223a559 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -52,7 +52,7 @@ Runs comprehensive quality checks on every pull request and push to main branch. ### Required Variables -- `GO_VERSION` (default: 1.26.9) +- `GO_VERSION` (default: 1.26.10) ### Example diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3b004e08..4516e7c5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ # Required GitHub Secrets: None (all checks run without cloud credentials) # # Required GitHub Variables: -# - GO_VERSION: Go version to use (default: 1.26.9) +# - GO_VERSION: Go version to use (default: 1.26.10) # # Triggered by: # - Pull requests to main/develop @@ -26,7 +26,7 @@ on: workflow_dispatch: env: - GO_VERSION: '1.26.9' + GO_VERSION: '1.26.10' jobs: lint: diff --git a/CHANGELOG.md b/CHANGELOG.md index 93b1a002..012bb03b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -215,6 +215,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/). ### Fixed +- Bump Go to 1.26.10 to pick up the fix for GO-2026-6809 (crypto/x509), which `govulncheck` now reports against 1.26.9. - **`ReshapeBuffer` rejects nil payment caps** instead of mapping them to `math.MaxFloat64`: `MaxPaymentPerExchangeUSD` and `MaxPaymentDailyUSD` are now required, so an omitted cap can no longer mean unlimited spend on diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index db8e4145..cb859013 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -49,7 +49,7 @@ By participating in this project, you agree to maintain a respectful and inclusi ### Prerequisites -- Go 1.26.9 or later, as declared by the module files +- Go 1.26.10 or later, as declared by the module files - Cloud credentials only when intentionally running a cloud-backed sanity binary - Git diff --git a/README.md b/README.md index 19e82f62..a71bf4b0 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ There is no root Go module. Use the module directories above when you inspect, b ## Build and test -Use the Go version declared in each module's `go.mod` (currently Go 1.26.9). +Use the Go version declared in each module's `go.mod` (currently Go 1.26.10). ```bash make build diff --git a/ci_cd_sanity_tests/go.mod b/ci_cd_sanity_tests/go.mod index 70d23083..f7512d58 100644 --- a/ci_cd_sanity_tests/go.mod +++ b/ci_cd_sanity_tests/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/cloud-commitments-go/ci_cd_sanity_tests -go 1.26.9 +go 1.26.10 require ( github.com/aws/aws-sdk-go-v2 v1.41.5 diff --git a/go.work b/go.work index fa5d5d54..30a53c11 100644 --- a/go.work +++ b/go.work @@ -1,4 +1,4 @@ -go 1.26.9 +go 1.26.10 use ( ./pkg diff --git a/pkg/go.mod b/pkg/go.mod index 32c6ae62..19ffd107 100644 --- a/pkg/go.mod +++ b/pkg/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/cloud-commitments-go/pkg -go 1.26.9 +go 1.26.10 // This module contains shared types, provider interfaces, and the exchange package. // The exchange package uses the AWS SDK v2 EC2 client stack for RI exchange operations. diff --git a/providers/aws/go.mod b/providers/aws/go.mod index 9b43fd22..7720ffcf 100644 --- a/providers/aws/go.mod +++ b/providers/aws/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/cloud-commitments-go/providers/aws -go 1.26.9 +go 1.26.10 require ( github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3 diff --git a/providers/azure/go.mod b/providers/azure/go.mod index 9051611d..0002888a 100644 --- a/providers/azure/go.mod +++ b/providers/azure/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/cloud-commitments-go/providers/azure -go 1.26.9 +go 1.26.10 require ( github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 diff --git a/providers/gcp/go.mod b/providers/gcp/go.mod index 2707a4db..a38b3a17 100644 --- a/providers/gcp/go.mod +++ b/providers/gcp/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/cloud-commitments-go/providers/gcp -go 1.26.9 +go 1.26.10 require ( cloud.google.com/go/compute v1.54.0