chore(deps): bump go directive to 1.26.4#1210
Conversation
go.mod was pinned to 1.26.1, which still ships the stdlib advisories fixed across 1.26.2-1.26.4. build.yaml sets up Go with go-version-file: go.mod, so CI and the from-source toolchain floor both stay on the vulnerable patch. Bumping to 1.26.4 pulls in the patched stdlib. Module deps are already current on main, so this is toolchain-only; go mod tidy is otherwise a no-op and govulncheck comes back clean.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
Walkthrough
ChangesGo toolchain update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1210 +/- ##
===========================================
- Coverage 62.36% 30.71% -31.65%
===========================================
Files 197 239 +42
Lines 4854 6534 +1680
===========================================
- Hits 3027 2007 -1020
- Misses 1439 4351 +2912
+ Partials 388 176 -212
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The
godirective ingo.modis pinned to1.26.1. That patch still carries the stdlib advisories that were fixed across 1.26.2–1.26.4.build.yamlsets up Go withgo-version-file: go.mod, so CI keeps building and testing on 1.26.1, and anyone building from source inherits the same floor. Bumping the directive to 1.26.4 pulls in the patched stdlib.Module dependencies are already current on
main, so this is toolchain-only —go mod tidyis otherwise a no-op.Checked locally before opening:
go build ./...andgo vet ./...passgo test ./...passesgovulncheck ./...reports no vulnerabilities