Fix Security CI: golang.org/x/net v0.60.0 and Go toolchain 1.26.9

Merged
JE
3d ago
+6-4

The Security (govulncheck, in test.yml) and Trivy Security Scan checks fail on main (b80505ee, and 40e47577 since the 06:46 UTC scheduled run on 2026-10-12) and on every PR branch. Nothing in the repo changed: the Go vulnerability database published new HTTP/2 and stdlib advisories, and the findings are real.

Findings and fixes

FindingModuleFoundFixedReported by
CVE-2026-78669 (HIGH), HTTP/2 SETTINGS DoSgolang.org/x/netv0.59.0v0.60.0Trivy
GO-2026-6617, -6612, -6611, -6610, -6603golang.org/x/net and net/httpv0.59.0 / go1.26.7v0.60.0 / go1.26.9govulncheck
GO-2026-6613, -6605net/httpgo1.26.7go1.26.9govulncheck
GO-2026-6608net/textprotogo1.26.7go1.26.9govulncheck
GO-2026-6607crypto/tlsgo1.26.7go1.26.9govulncheck
GO-2026-6600, -6599html/templatego1.26.7go1.26.9govulncheck
  • golang.org/x/net v0.59.0 -> v0.60.0 (no other module moved)
  • toolchain go1.26.9 added to go.mod; the go 1.26.7 line stays as it is
  • nix/package.nix vendorHash recomputed for the changed go.sum (make update-nix-hash, verified build)

Why toolchain and not go 1.26.9

Every workflow uses actions/setup-go with go-version-file: go.mod, and setup-go honors the toolchain directive, so CI, govulncheck and release binaries build with 1.26.9 (the CI log shows Setup go version spec 1.26.9). The directive also applies to builds from a checkout. It does not apply to go install github.com/basecamp/basecamp-cli/cmd/basecamp@latest, because a versioned install has no main module and only switches toolchains when the go line requires it. Someone who installs that way with Go 1.26.7 or 1.26.8 still gets the vulnerable stdlib (raised by both reviewers; a correction to this description's first version). Raising the go line would also raise the minimum Go needed to build, past what nixpkgs-unstable carries today (go_1_26 = 1.26.8), and the Nix flake build would fail. With this change Nix keeps building with GOTOOLCHAIN=local against the unchanged 1.26.7 minimum; its binaries carry whatever Go nixpkgs pins. Closing the go install gap needs go 1.26.9, and today that means either a red Nix flake build or overriding nixpkgs' Go with 1.26.9 built from source in nix/package.nix until nixpkgs ships it. 1.26.9 isn't on nixpkgs master, nixos-unstable or nixpkgs-unstable yet (all at 1.26.8). Human decision, see the open review threads: merge this as is and raise the go line in a follow-up when nixpkgs catches up, or add the Nix override here.

Nothing is silenced: no ignore files, and no workflow files changed.

Verification (local, macOS)

  • govulncheck -tags dev ./...: 11 reachable before, 0 after. One unreachable module finding remains, GO-2026-5932 (x/crypto/openpgp, unmaintained, no fix). It was already there before this change and doesn't fail the check.
  • trivy fs --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 .: 1 HIGH before, 0 after, exit 0
  • make update-nix-hash: Nix build passes in Docker with the new vendorHash
  • make check ran on macOS because the Linux build host was unreachable (Tailscale re-auth needed). Results: GOOS=linux golangci-lint found 0 issues. Every other target passed except test, where the TTY-detection tests fail in this sandboxed shell. The macOS lint flags two issues in proctime_darwin.go; that file is Darwin-only, isn't touched here, and CI lints on Linux. All PR CI is green on Linux, including Tests, Race Detection, Nix flake builds, Security and Trivy Security Scan.

Summary by cubic

Fixes the failing Security (govulncheck) and Trivy Security Scan workflows by updating golang.org/x/net from v0.59.0 to v0.60.0 and adding toolchain go1.26.9 to go.mod. The failures came from new HTTP/2 and stdlib advisories published in the Go vulnerability database; nothing in the repo changed.

  • The go 1.26.7 line stays unchanged; the toolchain directive raises the version used by setup-go and go install without raising the build floor, so the Nix flake still builds with nixpkgs' 1.26.7 Go.
  • vendorHash in nix/package.nix recomputed for the updated go.sum.
  • Nothing silenced: no ignore files or workflow changes were added.