opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-29 17:44:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: bump Go version from 1.26.4 to 1.26.5 (#27157)

Browse Source 
## Summary

Bump Go toolchain from 1.26.4 to 1.26.5.

Go 1.26.5 ([released
2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes
security fixes addressing:

- [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) —
`os` package
- [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) —
`crypto/tls` package

These were flagged by the IronBank scan of
`coder/coder-enterprise/coder-service-2:2.34.5`.

## Changes

- `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor)
- `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is
what actually compiles the scanned artifact and clears the CVEs)

## Related

- #27159 — backport to `release/2.35`
- #27158 — backport to `release/2.34`

Linear: ENT-129
This commit is contained in:
Denis Afonso
2026-07-14 12:49:05 +02:00
committed by GitHub
parent 55b06f14a3
commit 553c9ecbc8
3 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/coder/coder/v2
go 1.26.4
go 1.26.5
// Required until a v3 of chroma is created to lazily initialize all XML files.
// None of our dependencies seem to use the registries anyways, so this
mise.lock
+23 -23
View File
@@ -481,52 +481,52 @@ checksum = "sha256:e1245a0a760a45b236e7a25bf118c1defc8447734bdeb4260ea3ec15d1797
url = "https://github.com/digitalocean/doctl/releases/download/v1.158.0/doctl-1.158.0-windows-amd64.zip"
[[tools.go]]
version = "1.26.4"
version = "1.26.5"
backend = "core:go"
[tools.go."platforms.linux-arm64"]
checksum = "sha256:ef758ae7c6cf9267c9c0ef080b8965f453d89ab2d25d9eb22de4405925238768"
url = "https://dl.google.com/go/go1.26.4.linux-arm64.tar.gz"
checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"
[tools.go."platforms.linux-arm64-musl"]
checksum = "sha256:ef758ae7c6cf9267c9c0ef080b8965f453d89ab2d25d9eb22de4405925238768"
url = "https://dl.google.com/go/go1.26.4.linux-arm64.tar.gz"
checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"
[tools.go."platforms.linux-x64"]
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-baseline"]
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-musl"]
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-musl-baseline"]
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
[tools.go."platforms.macos-arm64"]
checksum = "sha256:b62ad2b6d7d2464f12a5bcad7ff47f19d08325773b5efd21610e445a05a9bf53"
url = "https://dl.google.com/go/go1.26.4.darwin-arm64.tar.gz"
checksum = "sha256:efb87ff28af9a188d0536ef5d42e63dd52ba8263cd7344a993cc48dd11dedb6a"
url = "https://dl.google.com/go/go1.26.5.darwin-arm64.tar.gz"
[tools.go."platforms.macos-x64"]
checksum = "sha256:05dc9b5f9997744520aaebb3d5deaa7c755371aebbfb7f97c2511a9f3367538d"
url = "https://dl.google.com/go/go1.26.4.darwin-amd64.tar.gz"
checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725"
url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz"
[tools.go."platforms.macos-x64-baseline"]
checksum = "sha256:05dc9b5f9997744520aaebb3d5deaa7c755371aebbfb7f97c2511a9f3367538d"
url = "https://dl.google.com/go/go1.26.4.darwin-amd64.tar.gz"
checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725"
url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz"
[tools.go."platforms.windows-x64"]
checksum = "sha256:3ca8fb4630b07c419cbdd51f754e31363cfcfb83b3a5354d9e895c90be2cc345"
url = "https://dl.google.com/go/go1.26.4.windows-amd64.zip"
checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38"
url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip"
[tools.go."platforms.windows-x64-baseline"]
checksum = "sha256:3ca8fb4630b07c419cbdd51f754e31363cfcfb83b3a5354d9e895c90be2cc345"
url = "https://dl.google.com/go/go1.26.4.windows-amd64.zip"
checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38"
url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip"
[[tools."go:github.com/coder/paralleltestctx/cmd/paralleltestctx"]]
version = "0.0.2"
mise.toml
+1 -1
View File
@@ -9,7 +9,7 @@ lockfile = true
[tools]
# Languages and runtimes.
bun = "1.2.15"
go = "1.26.4"
go = "1.26.5"
node = "22.19.0"
pnpm = "10.33.2"