From d9146bcd872cfb0f011006c5ab90e9e6040dfd7d Mon Sep 17 00:00:00 2001 From: gw0 Date: Wed, 23 Sep 2026 08:03:27 +0000 Subject: [PATCH] Bump release Go toolchain to fix stale stdlib CVEs go-version: 1.24 in release.yaml fell out of Go's security-backport window, so release binaries stopped getting stdlib patches. Track a .go-version instead and bump toolchain to go1.27.1. --- .github/workflows/release.yaml | 2 +- .go-version | 1 + go.mod | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 .go-version diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 8033962d..5ecedeaa 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -36,7 +36,7 @@ jobs: - name: Setup Go uses: actions/setup-go@v5 with: - go-version: 1.24 + go-version-file: .go-version check-latest: true cache: true - name: Install Cosign diff --git a/.go-version b/.go-version new file mode 100644 index 00000000..08002f86 --- /dev/null +++ b/.go-version @@ -0,0 +1 @@ +1.27.1 diff --git a/go.mod b/go.mod index f0f079d7..5451090d 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/google/yamlfmt go 1.22 -toolchain go1.24.8 +toolchain go1.27.1 require ( github.com/bmatcuk/doublestar/v4 v4.7.1