From 4c84333401e7b0190b3b740b570ceb81e38f8190 Mon Sep 17 00:00:00 2001 From: Pau Morillas Date: Fri, 23 Oct 2026 17:44:11 +0200 Subject: [PATCH] build: go 1.26.10 for GO-2026-6809 govulncheck, which CI runs as a failing check, reports GO-2026-6809 (crypto/x509 trusting compromised intermediates) on go1.26.9, reached through every HTTPS call this CLI makes. It is fixed in go1.26.10. The same finding is on main today, so without this the vulnerability job fails here and on the next push to main, and tag.yml publishes nothing from a commit whose CI did not pass. Only the go directive moves; no dependency changes. Co-Authored-By: Claude Opus 5.5 --- CONTRIBUTING.md | 2 +- README.md | 2 +- go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 609f35e..25a4ef5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,7 +4,7 @@ Thanks for your interest in contributing. This document covers how to get the pr ## Prerequisites -- **Go 1.26.9+** — the version in `go.mod`, which is where the standard +- **Go 1.26.10+** — the version in `go.mod`, which is where the standard library carries the current security fixes. The project uses [mise](https://mise.jdx.dev/) to pin the version. Run `mise install` in the repo root and Go will be available automatically. - A [nan.builders](https://nan.builders) account with an API key (needed to test the TUI at runtime). diff --git a/README.md b/README.md index fa9d30a..3d34166 100644 --- a/README.md +++ b/README.md @@ -332,7 +332,7 @@ history and in `ps`. ## Build from source -Requires Go 1.26.9+ ([mise](https://mise.jdx.dev/) recommended) — the version +Requires Go 1.26.10+ ([mise](https://mise.jdx.dev/) recommended) — the version in `go.mod`, which is where the standard library carries the current security fixes: diff --git a/go.mod b/go.mod index 66f3047..37ecc08 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/nxssie/nan-cli -go 1.26.9 +go 1.26.10 require ( github.com/charmbracelet/bubbles v1.0.0