From 4a68dcb00abed507b4dd6a312a3979c8336980c1 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Mon, 17 Aug 2026 19:45:26 +0100
Subject: [PATCH] fix(build): pin Go toolchain to 1.26.6 for standard-library
 CVE fixes

Builds used the go1.26.5 toolchain, whose standard library contained seven vulnerabilities that govulncheck reported as reachable (GO-2026-6218, GO-2026-6091, GO-2026-6090, GO-2026-6089, GO-2026-6088, GO-2026-5972, GO-2026-5026). This change pins the module toolchain to go1.26.6 and sets the CI Go version to 1.26.6, so every build compiles against the patched standard library. After the bump govulncheck reports zero vulnerabilities affecting the code. The go language directive stays at 1.25.0, so no language behaviour changes.
---
 .github/workflows/autoupdate.yaml | 2 +-
 .github/workflows/pr.yaml         | 2 +-
 .github/workflows/release.yaml    | 4 ++--
 go.mod                            | 2 ++
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/autoupdate.yaml b/.github/workflows/autoupdate.yaml
index b043ac6..5bfff3a 100644
--- a/.github/workflows/autoupdate.yaml
+++ b/.github/workflows/autoupdate.yaml
@@ -14,6 +14,6 @@ jobs:
   autoupdate:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
     with:
-      go-version: ">=1.24"
+      go-version: ">=1.26.6"
       release-workflow: "release.yaml"
     secrets: inherit
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 0fe75ce..e1646e6 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -13,4 +13,4 @@ jobs:
   pr-checks:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main
     with:
-      go-version: "1.24"
+      go-version: "1.26.6"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5f2a924..64bd1c3 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -21,7 +21,7 @@ jobs:
   release:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
     with:
-      go-version: "1.25"
+      go-version: "1.26.6"
       docker-enabled: true
     secrets: inherit
 
@@ -39,7 +39,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.25"
+          go-version: "1.26.6"
 
       - name: Run benchmarks
         run: go test -bench=. -benchmem ./... -run=^# | tee output.txt
diff --git a/go.mod b/go.mod
index 725864d..574049d 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/lukaszraczylo/graphql-monitoring-proxy
 
 go 1.25.0
 
+toolchain go1.26.6
+
 require (
 	github.com/MicahParks/keyfunc/v3 v3.8.1
 	github.com/VictoriaMetrics/metrics v1.44.0