lukaszraczylo/harness-sync
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/harness-sync.git synced 2026-10-12 00:45:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): bump go.mod toolchain to 1.25.10 to clear govulncheck (#8)

Browse Source 
Security Scan workflow on main failed with 18 standard-library
vulnerabilities (GO-2025-4007..4015, GO-2025-4155, GO-2026-4337,
plus a few more). All are fixed in later 1.25.x patches. Lowest
1.25.x version that govulncheck accepts clean is 1.25.10.

go.sum unchanged — the repo's go.sum already pointed at
oss-telemetry v0.2.3 and go-runewidth v0.0.24, which is what
1.25.10 + tidy resolves to.

Verified locally with GOTOOLCHAIN=go1.25.10:
  - go build ./...            clean
  - go test -count=1 ./...    20/20 packages pass
  - govulncheck ./...         No vulnerabilities found

go-version-file: go.mod in lint.yaml and security.yaml will
auto-pick the new version; no workflow changes needed.
This commit is contained in:
lukaszraczylo
2026-06-01 13:32:30 +01:00
committed by GitHub
parent e01f3419ea
commit 6534261fe4
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/lukaszraczylo/harness-sync
go 1.25.0
go 1.25.10
require (
github.com/charmbracelet/huh v1.0.0