From ec69e23478efa9cd4729a2622ae5776fa67ab943 Mon Sep 17 00:00:00 2001 From: Rob Zolkos Date: Mon, 13 Jul 2026 09:56:54 -0400 Subject: [PATCH] Bump Go toolchain to 1.26.5 Address GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls), a Go standard-library vulnerability present in 1.26.4 and fixed in 1.26.5. CI builds with the version pinned by the go directive in go.mod (all workflows use go-version-file: 'go.mod'), so this was failing the Security / govulncheck job on every branch. Verified: govulncheck reports the vuln under go1.26.4 and reports "No vulnerabilities found" under go1.26.5. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 982c00e31..5e0c0095f 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/basecamp/basecamp-cli -go 1.26.4 +go 1.26.5 require ( charm.land/bubbles/v2 v2.1.0