From 455d770899b787c517259e4e38e594eae6c728f8 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Wed, 19 Aug 2026 06:31:22 +0100 Subject: [PATCH] ci: track the latest Go 1.25 patch instead of pinning one (#2156) govulncheck fails on master against the 1.25.12 pin with seven stdlib advisories, all fixed in 1.25.13: GO-2026-5026, GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091 and GO-2026-6218, across crypto/tls, encoding/asn1, encoding/xml, html/template, net/http and net/url. Pinning the next patch would only move the problem to the following advisory, as it did in 76d0cc2c. setup-go accepts a minor-only spec, so "1.25" resolves to a patch on that line at run time. Staying on 1.25 rather than "stable" keeps a move to a new minor a deliberate change, matching the `go 1.25.0` directive in both go.mod files. check-latest is required with it: by default setup-go uses the patch already cached on the runner image, so a minor-only spec alone would keep resolving to whatever that image ships, currently 1.25.12, and the scan would stay red. --- .github/workflows/ci-backend.yml | 6 ++++-- .github/workflows/release.yml | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-backend.yml b/.github/workflows/ci-backend.yml index 4b2a295c..4c801961 100644 --- a/.github/workflows/ci-backend.yml +++ b/.github/workflows/ci-backend.yml @@ -42,7 +42,8 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25" + check-latest: true cache-dependency-path: backend - name: test and build backend @@ -97,7 +98,8 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25" + check-latest: true # both go.sum files so the cache key covers the main and example modules scanned below cache-dependency-path: | backend/go.sum diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8dcab20c..549c5b09 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,7 +32,8 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25" + check-latest: true cache-dependency-path: backend/go.sum - name: install pnpm @@ -107,7 +108,8 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25" + check-latest: true cache-dependency-path: backend/go.sum - name: install pnpm