From 5b45a7b4b875a941434b56769d053bdbc65feb3d Mon Sep 17 00:00:00 2001 From: Sourya Vatsyayan Date: Mon, 26 Oct 2026 14:03:35 +0530 Subject: [PATCH 1/2] fix(security): build with Go 1.26.10 for crypto/x509 eMudhra distrust (GO-2026-6809) The Oct 2026 eMudhra compromise made emSign ECC Root CA - G3 and AAA Certificate Services untrusted. Updated trust stores: certifi 2026.10.23, Alpine ca-certificates 20261020-r0 (3.18+), Debian bookworm 20250419~deb12u2, Node 22.23.4 / 24.22.1, Go 1.26.10. --- .github/workflows/CI.yml | 2 +- .github/workflows/build-and-deploy.yml | 2 +- go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index a4881143..931ce3df 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -16,7 +16,7 @@ jobs: - name: Set up Go 1.x uses: actions/setup-go@v5 with: - go-version: '1.25' + go-version: '1.26.10' - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml index 598a0351..e6014f40 100644 --- a/.github/workflows/build-and-deploy.yml +++ b/.github/workflows/build-and-deploy.yml @@ -10,7 +10,7 @@ permissions: contents: read env: - GO_VERSION: '1.25' + GO_VERSION: '1.26.10' jobs: resolve-env: diff --git a/go.mod b/go.mod index 4dc5b704..37f1b97d 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/deepsourcelabs/cli go 1.25.3 -toolchain go1.25.12 +toolchain go1.26.10 require ( github.com/AlecAivazis/survey/v2 v2.3.7 From 28a9454d2d3426499c7f2d3980dada1d15b0e8bf Mon Sep 17 00:00:00 2001 From: Sourya Vatsyayan Date: Thu, 29 Oct 2026 12:19:06 +0530 Subject: [PATCH 2/2] fix(security): require go 1.26.10 in go.mod The toolchain line is only a preference: it is ignored under GOTOOLCHAIN=local and when the module is a dependency, so a source build with Go 1.25 (EOL, no fix for GO-2026-6809) still succeeded. Raising the go directive makes 1.26.10 a hard minimum; the toolchain line is dropped as redundant. Co-Authored-By: Claude Opus 5.5 --- go.mod | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 37f1b97d..1c355962 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,6 @@ module github.com/deepsourcelabs/cli -go 1.25.3 - -toolchain go1.26.10 +go 1.26.10 require ( github.com/AlecAivazis/survey/v2 v2.3.7