opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-01 14:53:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: upgrade Go toolchain from 1.26.2 to 1.26.4 (#26066)

Browse Source 
Upgrades the Go toolchain from 1.26.2 to 1.26.4 to address two stdlib
CVEs:

- **CVE-2026-27145** (Low): `crypto/x509` `VerifyHostname` has quadratic
cost with large DNS SAN lists, enabling DoS with untrusted certificates.
- **CVE-2026-42507** (Low): `net/textproto` includes attacker-controlled
input in errors without escaping, enabling log injection.

### Changes

- `go.mod`: Bump `go` directive from 1.26.2 to 1.26.4
- `mise.toml`: Bump `go` tool version from 1.26.2 to 1.26.4
- `mise.lock`: Regenerated with updated Go checksums

Resolves ENT-104

> Generated by Coder Agents on behalf of @Shelnutt2
This commit is contained in:
Seth Shelnutt
2026-06-04 11:22:28 -04:00
committed by GitHub
parent 6366c380fe
commit 61a35185cf
3 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/coder/coder/v2
go 1.26.2
go 1.26.4
// Required until a v3 of chroma is created to lazily initialize all XML files.
// None of our dependencies seem to use the registries anyways, so this
mise.lock
+23 -23
View File
@@ -433,52 +433,52 @@ checksum = "sha256:e1245a0a760a45b236e7a25bf118c1defc8447734bdeb4260ea3ec15d1797
url = "https://github.com/digitalocean/doctl/releases/download/v1.158.0/doctl-1.158.0-windows-amd64.zip"
[[tools.go]]
version = "1.26.2"
version = "1.26.4"
backend = "core:go"
[tools.go."platforms.linux-arm64"]
checksum = "sha256:c958a1fe1b361391db163a485e21f5f228142d6f8b584f6bef89b26f66dc5b23"
url = "https://dl.google.com/go/go1.26.2.linux-arm64.tar.gz"
checksum = "sha256:ef758ae7c6cf9267c9c0ef080b8965f453d89ab2d25d9eb22de4405925238768"
url = "https://dl.google.com/go/go1.26.4.linux-arm64.tar.gz"
[tools.go."platforms.linux-arm64-musl"]
checksum = "sha256:c958a1fe1b361391db163a485e21f5f228142d6f8b584f6bef89b26f66dc5b23"
url = "https://dl.google.com/go/go1.26.2.linux-arm64.tar.gz"
checksum = "sha256:ef758ae7c6cf9267c9c0ef080b8965f453d89ab2d25d9eb22de4405925238768"
url = "https://dl.google.com/go/go1.26.4.linux-arm64.tar.gz"
[tools.go."platforms.linux-x64"]
checksum = "sha256:990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282"
url = "https://dl.google.com/go/go1.26.2.linux-amd64.tar.gz"
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-baseline"]
checksum = "sha256:990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282"
url = "https://dl.google.com/go/go1.26.2.linux-amd64.tar.gz"
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-musl"]
checksum = "sha256:990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282"
url = "https://dl.google.com/go/go1.26.2.linux-amd64.tar.gz"
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
[tools.go."platforms.linux-x64-musl-baseline"]
checksum = "sha256:990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282"
url = "https://dl.google.com/go/go1.26.2.linux-amd64.tar.gz"
checksum = "sha256:1153d3d50e0ac764b447adfe05c2bcf08e889d42a02e0fe0259bd47f6733ad7f"
url = "https://dl.google.com/go/go1.26.4.linux-amd64.tar.gz"
[tools.go."platforms.macos-arm64"]
checksum = "sha256:32af1522bf3e3ff3975864780a429cc0b41d190ec7bf90faa661d6d64566e7af"
url = "https://dl.google.com/go/go1.26.2.darwin-arm64.tar.gz"
checksum = "sha256:b62ad2b6d7d2464f12a5bcad7ff47f19d08325773b5efd21610e445a05a9bf53"
url = "https://dl.google.com/go/go1.26.4.darwin-arm64.tar.gz"
[tools.go."platforms.macos-x64"]
checksum = "sha256:bc3f1500d9968c36d705442d90ba91addf9271665033748b82532682e90a7966"
url = "https://dl.google.com/go/go1.26.2.darwin-amd64.tar.gz"
checksum = "sha256:05dc9b5f9997744520aaebb3d5deaa7c755371aebbfb7f97c2511a9f3367538d"
url = "https://dl.google.com/go/go1.26.4.darwin-amd64.tar.gz"
[tools.go."platforms.macos-x64-baseline"]
checksum = "sha256:bc3f1500d9968c36d705442d90ba91addf9271665033748b82532682e90a7966"
url = "https://dl.google.com/go/go1.26.2.darwin-amd64.tar.gz"
checksum = "sha256:05dc9b5f9997744520aaebb3d5deaa7c755371aebbfb7f97c2511a9f3367538d"
url = "https://dl.google.com/go/go1.26.4.darwin-amd64.tar.gz"
[tools.go."platforms.windows-x64"]
checksum = "sha256:98eb3570bade15cb826b0909338df6cc6d2cf590bc39c471142002db3832b708"
url = "https://dl.google.com/go/go1.26.2.windows-amd64.zip"
checksum = "sha256:3ca8fb4630b07c419cbdd51f754e31363cfcfb83b3a5354d9e895c90be2cc345"
url = "https://dl.google.com/go/go1.26.4.windows-amd64.zip"
[tools.go."platforms.windows-x64-baseline"]
checksum = "sha256:98eb3570bade15cb826b0909338df6cc6d2cf590bc39c471142002db3832b708"
url = "https://dl.google.com/go/go1.26.2.windows-amd64.zip"
checksum = "sha256:3ca8fb4630b07c419cbdd51f754e31363cfcfb83b3a5354d9e895c90be2cc345"
url = "https://dl.google.com/go/go1.26.4.windows-amd64.zip"
[[tools."go:github.com/coder/paralleltestctx/cmd/paralleltestctx"]]
version = "0.0.2"
mise.toml
+1 -1
View File
@@ -9,7 +9,7 @@ lockfile = true
[tools]
# Languages and runtimes.
bun = "1.2.15"
go = "1.26.2"
go = "1.26.4"
node = "22.19.0"
pnpm = "10.33.2"