Build with Go 1.26.11 for net/http's GO-2026-6859

Merged
JE
1d ago
+2-2

GO-2026-6859 in the standard library's net/http is fixed in go1.26.11.
The govulncheck job runs on stable, but the test and release jobs read
go.mod, so released binaries were built on 1.26.9. Bring .mise.toml,
which had drifted to 1.26.6, up to match.

Verified locally on go1.26.11: build, vet, go test ./... and govulncheck v1.8.0 pass (no reachable vulnerabilities).

Summary by cubic

Upgrades the Go toolchain to 1.26.11 to fix GO-2026-6859 in the standard library's net/http package.

  • Released binaries were built with Go 1.26.9, and .mise.toml had drifted further behind at 1.26.6.
  • Bumps go.mod to go 1.26.11 and .mise.toml to match, so test and release jobs build with the fixed toolchain.
  • Verified locally on go1.26.11: build, vet, go test ./..., and govulncheck v1.8.0 pass with no reachable vulnerabilities.

RetriggerView in GreptileConfidence Score: 5/5

This PR appears safe to merge.

Summary

Updates the Go build requirement to 1.26.11.

  • Local and release builds now use Go 1.26.11.

Reviews (1) · Last reviewed commit: "Build with Go 1.26.11 for net/http's GO-..." · Reviewed by Greptile