Repository navigation
Fix Security CI: golang.org/x/net v0.60.0 and Go toolchain 1.26.9 - #886
Conversation
govulncheck and Trivy began failing on main and every PR when the Go vulnerability database published the October HTTP/2 and stdlib advisories. No code or dependency changed; the findings are real: - golang.org/x/net v0.59.0 -> v0.60.0 (Trivy CVE-2026-78669, HIGH; govulncheck GO-2026-6617, -6612, -6611, -6610, -6603) - Go stdlib 1.26.7 -> 1.26.9 (govulncheck GO-2026-6617, -6613, -6612, -6611, -6610, -6608, -6607, -6605, -6603, -6600, -6599 in net/http, net/textproto, crypto/tls, html/template) The stdlib fix goes in a toolchain directive rather than the go line. setup-go reads it, so CI and release binaries build with 1.26.9, as does go install under the default GOTOOLCHAIN=auto. Raising the go line would also raise the build floor past what nixpkgs-unstable carries (1.26.8), breaking the Nix flake build, which keeps building with GOTOOLCHAIN=local against the unchanged 1.26.7 floor. vendorHash recomputed for the changed go.sum via make update-nix-hash.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 3 files
You’re at about 93% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 49ffc1e1d9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🟡 Changes recommended
The toolchain directive does not secure documented version-suffixed go install builds using Go 1.26.7 or 1.26.8.
1 open finding
What changed in this PR
Updates Go dependencies and CI-selected toolchain to address newly reported security vulnerabilities.
Changes:
- Upgrades
golang.org/x/netto v0.60.0. - Selects Go 1.26.9 and refreshes dependency checksums.
- Recomputes the Nix vendor hash.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
go.mod |
Updates x/net and adds the toolchain directive. |
go.sum |
Updates x/net checksums. |
nix/package.nix |
Refreshes the Nix vendor hash. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
🤖 Review summary for head 49ffc1e CI is green on this head, including Open threads (2), both awaiting a human decision, and both the same finding:
No findings declined; nothing resolved. |
The
Security(govulncheck, in test.yml) andTrivy Security Scanchecks fail on main (b80505e, and 40e4757 since the 06:46 UTC scheduled run on 2026-10-12) and on every PR branch. Nothing in the repo changed: the Go vulnerability database published new HTTP/2 and stdlib advisories, and the findings are real.Findings and fixes
golang.org/x/netv0.59.0 -> v0.60.0 (no other module moved)toolchain go1.26.9added to go.mod; thego 1.26.7line stays as it isnix/package.nixvendorHash recomputed for the changed go.sum (make update-nix-hash, verified build)Why
toolchainand notgo 1.26.9Every workflow uses
actions/setup-gowithgo-version-file: go.mod, and setup-go honors the toolchain directive, so CI, govulncheck and release binaries build with 1.26.9 (the CI log showsSetup go version spec 1.26.9). The directive also applies to builds from a checkout. It does not apply togo install github.com/basecamp/basecamp-cli/cmd/basecamp@latest, because a versioned install has no main module and only switches toolchains when thegoline requires it. Someone who installs that way with Go 1.26.7 or 1.26.8 still gets the vulnerable stdlib (raised by both reviewers; a correction to this description's first version). Raising thegoline would also raise the minimum Go needed to build, past what nixpkgs-unstable carries today (go_1_26 = 1.26.8), and the Nix flake build would fail. With this change Nix keeps building withGOTOOLCHAIN=localagainst the unchanged 1.26.7 minimum; its binaries carry whatever Go nixpkgs pins. Closing thego installgap needsgo 1.26.9, and today that means either a red Nix flake build or overriding nixpkgs' Go with 1.26.9 built from source innix/package.nixuntil nixpkgs ships it. 1.26.9 isn't on nixpkgs master, nixos-unstable or nixpkgs-unstable yet (all at 1.26.8). Human decision, see the open review threads: merge this as is and raise thegoline in a follow-up when nixpkgs catches up, or add the Nix override here.Nothing is silenced: no ignore files, and no workflow files changed.
Verification (local, macOS)
govulncheck -tags dev ./...: 11 reachable before, 0 after. One unreachable module finding remains, GO-2026-5932 (x/crypto/openpgp, unmaintained, no fix). It was already there before this change and doesn't fail the check.trivy fs --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 .: 1 HIGH before, 0 after, exit 0make update-nix-hash: Nix build passes in Docker with the new vendorHashmake checkran on macOS because the Linux build host was unreachable (Tailscale re-auth needed). Results:GOOS=linux golangci-lintfound 0 issues. Every other target passed excepttest, where the TTY-detection tests fail in this sandboxed shell. The macOS lint flags two issues inproctime_darwin.go; that file is Darwin-only, isn't touched here, and CI lints on Linux. All PR CI is green on Linux, includingTests,Race Detection,Nix flake builds,SecurityandTrivy Security Scan.Summary by cubic
Fixes the failing
Security(govulncheck) andTrivy Security Scanworkflows by updatinggolang.org/x/netfrom v0.59.0 to v0.60.0 and addingtoolchain go1.26.9to go.mod. The failures came from new HTTP/2 and stdlib advisories published in the Go vulnerability database; nothing in the repo changed.go 1.26.7line stays unchanged; thetoolchaindirective raises the version used bysetup-goandgo installwithout raising the build floor, so the Nix flake still builds with nixpkgs' 1.26.7 Go.vendorHashinnix/package.nixrecomputed for the updated go.sum.Written for commit 49ffc1e. Summary will update on new commits.