Repository navigation
chore: bump Go to 1.26.4 - #9
Conversation
Fixes two Go stdlib vulnerabilities reported by govulncheck: - GO-2026-5039: arbitrary inputs in net/textproto errors - GO-2026-5037: inefficient candidate hostname parsing in crypto/x509 Both fixed in go1.25.11; this bumps to 1.26.4 (latest stable) to track the current Go minor and avoid recurring near-EOL patches on the 1.25 line. Changes: - go.mod: go 1.25.7 -> go 1.26.4 - test.yml: Go matrix '1.25.x' -> '1.26.x' (4 occurrences) Verified locally: `go test -race ./...` passes, `govulncheck ./...` reports no vulnerabilities in pingheat's code.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go version in the go.mod file from 1.25.7 to 1.26.4. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dada5e8218
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| module github.com/pbv7/pingheat | ||
|
|
||
| go 1.25.7 | ||
| go 1.26.4 |
There was a problem hiding this comment.
Raising the go directive to 1.26.4 makes Go 1.25 unsupported, but README.md:5,24 and CLAUDE.md:8,12 still explicitly advertise Go 1.25+ as sufficient. Developers following those prerequisites will fail to build when automatic toolchain downloads are disabled or unavailable (GOTOOLCHAIN=local or an offline environment), so the documented minimum should be updated alongside this change.
Useful? React with 👍 / 👎.
After bumping go.mod to 1.26.4, contributors with only Go 1.25 installed and GOTOOLCHAIN=local (or offline) would fail to build despite the docs saying Go 1.25+ is sufficient. Sync README and CLAUDE.md to match the new floor.
2 participants
Summary
Bumps Go to 1.26.4 (latest stable) to fix two stdlib vulnerabilities flagged by govulncheck on every PR's Security Scan:
net/textprotoerrors (fixed in go1.25.11)crypto/x509(fixed in go1.25.11)Both can be addressed by patch-bumping to 1.25.11, but 1.26.4 is the current latest stable and keeps us off the near-EOL 1.25 line.
Changes
go.mod:go 1.25.7→go 1.26.4.github/workflows/test.yml: Go matrix'1.25.x'→'1.26.x'(4 occurrences)Test plan
go test -race ./...passes locally on Go 1.26.4 (all 13 packages OK).govulncheck ./...reports 0 vulnerabilities in pingheat's code.Notes for other open PRs
This unblocks the Security Scan failure on:
Both will need a rebase onto main after this merges, then their Security Scan will go green too.