From d52ea2f0fa596a87c5803675a7089496925c08bc Mon Sep 17 00:00:00 2001 From: Travis Bischel Date: Mon, 8 Jun 2026 13:18:59 -0600 Subject: [PATCH] deps: bump Go to 1.26.4 to address Snyk findings Bumps the go directive (go.mod) and the builder base image (Dockerfile: golang:1.26.3-alpine -> 1.26.4-alpine) to clear two stdlib HIGH findings: - CVE-2026-27145 / GO-2026-5037 - crypto/x509 resource exhaustion - CVE-2026-42504 / GO-2026-5038 - net/mime resource exhaustion Both fixed in go1.26.4. Co-Authored-By: Claude Opus 4.8 (1M context) --- Dockerfile | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 947c0e7..84333d2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ ############################################################ # Build image ############################################################ -FROM golang:1.26.3-alpine AS builder +FROM golang:1.26.4-alpine AS builder ARG VERSION ARG BUILT_AT diff --git a/go.mod b/go.mod index 8e299fc..7a18a6d 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/cloudhut/kminion/v2 -go 1.26.3 +go 1.26.4 require ( github.com/google/uuid v1.6.0