#447: build with Go 1.25.14 — govulncheck clean #507

Merged

Cordy merged 3 commits from fix-447 into main

2026-09-12 17:38:34 +00:00

Cordy commented

2026-09-12 17:35:45 +00:00

Owner

Closes #447.

govulncheck (source mode, reachability) against main found 34 reachable vulnerabilities — every one in the Go standard library at go1.25.0 (crypto/x509, crypto/tls, net/http, net/url, net/textproto, encoding/asn1, encoding/pem, …), because the module's bare go 1.25 directive made every build use the unpatched 1.25.0 toolchain. No third-party dependency had a reachable vulnerability (x/crypto v0.54.0, x/net v0.57.0, grpc v1.83.0, protobuf v1.36.11 are all current).

Fix: go get go@patch → go 1.25.14. Full suite green under the new toolchain; govulncheck now reports "Your code is affected by 0 vulnerabilities" (4 findings remain in required-but-uncalled modules).

Closes #447. govulncheck (source mode, reachability) against main found **34 reachable vulnerabilities — every one in the Go standard library at go1.25.0** (crypto/x509, crypto/tls, net/http, net/url, net/textproto, encoding/asn1, encoding/pem, …), because the module's bare `go 1.25` directive made every build use the unpatched 1.25.0 toolchain. No third-party dependency had a reachable vulnerability (x/crypto v0.54.0, x/net v0.57.0, grpc v1.83.0, protobuf v1.36.11 are all current). Fix: `go get go@patch` → `go 1.25.14`. Full suite green under the new toolchain; govulncheck now reports **"Your code is affected by 0 vulnerabilities"** (4 findings remain in required-but-uncalled modules).

Cordy added 3 commits

2026-09-12 17:35:47 +00:00