Move to Go 1.26.9 and bump the modules Trivy flags

Merged
JE
13d ago
+12-12

Go Vulnerability Check and Trivy (Go) fail on main because the SDK builds against go1.26.6, which has standard-library vulnerabilities the code reaches.

Which release fixes them: govulncheck v1.1.4 on main reports Fixed in: …@go1.26.9 for all nine:

  • GO-2026-6603, -6605, -6610, -6611, -6612, -6613 and -6617 in net/http
  • GO-2026-6608 in net/textproto
  • GO-2026-6607 in crypto/tls

go1.26.9 is the current 1.26 release on go.dev/dl.

Commit 1: the toolchain. The go directive in go/go.mod, conformance/runner/go/go.mod and go.work moves from 1.26.6 to 1.26.9, as #158 did for the last bump.

  • No toolchain line exists or is needed, since the directive is the pin.
  • Every setup-go step in CI uses go-version-file: go/go.mod.
  • .mise.toml's go = "1.26" floats and already resolves to 1.26.9, so it stays as is.

Commit 2: two modules Trivy still flagged. On this PR's first run, govulncheck went green but Trivy (Go) still failed. The cause was two modules that oapi-codegen pulls in as a tool dependency:

  • kin-openapi v0.144.0, for CVE-2026-100349, -100351, -100352, -100353 and -100354. The highest fix among them is v0.149.0.
  • golang.org/x/text v0.39.0, for CVE-2026-56851, fixed in v0.41.0.

Both move to those minimum fixed versions. jsonschema/v6 comes along from 6.0.2 to 6.0.3. govulncheck never flagged them because the SDK doesn't call them. They were also failing Trivy on main.

Verified locally on go1.26.9:

  • govulncheck ./... in go/ reports No vulnerabilities found.
  • trivy fs --severity HIGH,CRITICAL --ignore-unfixed ./go reports 0.
  • go generate ./... leaves go/pkg/generated unchanged.
  • make go-check go-check-drift passes.
  • go mod tidy -diff is clean in both modules.