Skip to content

Bump Go to 1.26.11 and dependencies (stdlib CVEs) - #47

Merged
Alexandr Dejneka (deynekas) merged 6 commits into
masterfrom
bump-go-1.26.9
Nov 12, 2026
Merged

Alexandr Dejneka (deynekas) merged 6 commits into
masterfrom
bump-go-1.26.9

Conversation

@deynekas

@deynekas Alexandr Dejneka (deynekas) commented Nov 12, 2026 •

Copy link
Copy Markdown
Contributor
  • go directive 1.24.1 -> 1.26.11. The released helmgithub binary was flagged by Orca for ~66 stdlib CVEs. 1.26.9 fixes the Orca-listed ones, but govulncheck still found GO-2026-6859 (net/http, fixed in 1.26.11) and GO-2026-6809 (crypto/x509, fixed in 1.26.10) reachable from the binary. CI and release use go-version-file: go.mod, so releases are built with the patched toolchain.
  • golang.org/x/oauth2 0.34.0 -> 0.38.0, github.com/Masterminds/semver/v3 3.4.0 -> 3.5.0 (hygiene; govulncheck reported nothing in dependencies).
  • plugin.yaml 0.1.13 -> 0.1.14 so install.sh fetches the rebuilt release.

Verified: go build, go vet, govulncheck ./... clean (no vulnerabilities). No unit tests exist; not smoke-tested against a real private chart download.

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@deynekas Alexandr Dejneka (deynekas) changed the title Bump Go to 1.26.9 (stdlib CVEs) Bump Go to 1.26.11 (stdlib CVEs) Nov 12, 2026
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@deynekas Alexandr Dejneka (deynekas) changed the title Bump Go to 1.26.11 (stdlib CVEs) Bump Go to 1.26.11 and dependencies (stdlib CVEs) Nov 12, 2026
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@deynekas
Alexandr Dejneka (deynekas) merged commit 84d2589 into master Nov 12, 2026
6 checks passed
@deynekas
Alexandr Dejneka (deynekas) deleted the bump-go-1.26.9 branch November 12, 2026 11:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants