From 71d2cf592b1446456db6a9a64c7b0ecbf8a30dfc Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Fri, 14 Aug 2026 16:17:32 +0100 Subject: [PATCH] build: pin toolchain to go1.26.6 (resolves 5 reachable stdlib CVEs) - net/http, asn1, idna GO-2026 CVEs cleared; govulncheck now 0 findings --- go.mod | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/go.mod b/go.mod index c6718d5..6c49e4b 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,11 @@ module github.com/lukaszraczylo/traefikoidc go 1.24.0 +// Pin the toolchain to a stdlib version without the go1.26.5 CVEs +// (GO-2026-6089 net/http ReadHeaderTimeout, GO-2026-5972 asn1 recursion, +// GO-2026-5026 idna) reported by govulncheck (R219). Auto-downloaded. +toolchain go1.26.6 + require ( github.com/alicebob/miniredis/v2 v2.35.0 github.com/gorilla/sessions v1.3.0