fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.34) (#30811)

Backport of #30807 to `release/2.34`.

Bumps the Go toolchain from 1.26.5 to 1.26.9. Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). Same
approach as the Terraform 1.16.5 backports (#30516 and its backports).

Files changed: `go.mod`, `mise.toml`, `mise.lock`, and
`.github/actions/setup-go/action.yaml` (this branch also pins Go there).

Not built or scanned locally; CI will build it.

**Companion PR:** the module side of GO-2026-6612 (Critical), -6603,
-6610, -6611 and -6617 is fixed by `golang.org/x/net` v0.60.0,
backported in https://github.com/coder/coder/pull/30818
([ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)).
This PR alone does not clear them; both are needed.

Opened by Superblink on behalf of @droopy4096.
This commit is contained in:
Dmitry Makovey
2026-10-15 12:34:11 -07:00
committed by GitHub
parent 24cfb824a3
commit 5e15171d6f
4 changed files with 26 additions and 26 deletions
+1 -1
View File
@@ -4,7 +4,7 @@ description: |
inputs:
version:
description: "The Go version to use."
default: "1.26.5"
default: "1.26.9"
use-cache:
description: "Whether to use the cache."
default: "true"
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/coder/coder/v2
go 1.26.5
go 1.26.9
// Required until a v3 of chroma is created to lazily initialize all XML files.
// None of our dependencies seem to use the registries anyways, so this
+23 -23
View File
@@ -385,52 +385,52 @@ checksum = "sha256:e1245a0a760a45b236e7a25bf118c1defc8447734bdeb4260ea3ec15d1797
url = "https://github.com/digitalocean/doctl/releases/download/v1.158.0/doctl-1.158.0-windows-amd64.zip"
[[tools.go]]
version = "1.26.5"
version = "1.26.9"
backend = "core:go"
[tools.go."platforms.linux-arm64"]
checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"
checksum = "sha256:4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052"
url = "https://dl.google.com/go/go1.26.9.linux-arm64.tar.gz"
[tools.go."platforms.linux-arm64-musl"]
checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"
checksum = "sha256:4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052"
url = "https://dl.google.com/go/go1.26.9.linux-arm64.tar.gz"
[tools.go."platforms.linux-x64"]
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-baseline"]
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-musl"]
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-musl-baseline"]
checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
[tools.go."platforms.macos-arm64"]
checksum = "sha256:efb87ff28af9a188d0536ef5d42e63dd52ba8263cd7344a993cc48dd11dedb6a"
url = "https://dl.google.com/go/go1.26.5.darwin-arm64.tar.gz"
checksum = "sha256:f9bb7c0a02506c5d9bf0d1eb1f7ee6c7684f844ae49558308a0427b830e022cc"
url = "https://dl.google.com/go/go1.26.9.darwin-arm64.tar.gz"
[tools.go."platforms.macos-x64"]
checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725"
url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz"
checksum = "sha256:00c29e3d4c8562f547410daa18d2959b641bd691ab00c4a525ea817a0253d4bd"
url = "https://dl.google.com/go/go1.26.9.darwin-amd64.tar.gz"
[tools.go."platforms.macos-x64-baseline"]
checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725"
url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz"
checksum = "sha256:00c29e3d4c8562f547410daa18d2959b641bd691ab00c4a525ea817a0253d4bd"
url = "https://dl.google.com/go/go1.26.9.darwin-amd64.tar.gz"
[tools.go."platforms.windows-x64"]
checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38"
url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip"
checksum = "sha256:d722201a9c0c086d1610e111c48203009af690892ed708072bd5ae20160e7a59"
url = "https://dl.google.com/go/go1.26.9.windows-amd64.zip"
[tools.go."platforms.windows-x64-baseline"]
checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38"
url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip"
checksum = "sha256:d722201a9c0c086d1610e111c48203009af690892ed708072bd5ae20160e7a59"
url = "https://dl.google.com/go/go1.26.9.windows-amd64.zip"
[[tools."go:github.com/coder/sqlc/cmd/sqlc"]]
version = "337309bfb9524f38466a5090e310040fc7af0203"
+1 -1
View File
@@ -8,7 +8,7 @@ lockfile = true
[tools]
# Languages and runtimes.
bun = "1.2.15"
go = "1.26.5"
go = "1.26.9"
node = "22.19.0"
pnpm = "10.33.2"