From 76d0cc2cf66becc48f8f2b5125610675ca115d8a Mon Sep 17 00:00:00 2001 From: Umputun Date: Sat, 11 Jul 2026 02:05:58 -0500 Subject: [PATCH] fix(ci): pin go-version to 1.25.12 for GO-2026-5856 setup-go with go-version "1.25" resolved to 1.25.11, which govulncheck flags for GO-2026-5856 (ECH privacy leak in crypto/tls, fixed in go1.25.12). Pin the exact patch in ci-backend.yml and release.yml so the vuln scan passes and release binaries build on the fixed toolchain. --- .github/workflows/ci-backend.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-backend.yml b/.github/workflows/ci-backend.yml index aa92b7c5..4b2a295c 100644 --- a/.github/workflows/ci-backend.yml +++ b/.github/workflows/ci-backend.yml @@ -42,7 +42,7 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25" + go-version: "1.25.12" cache-dependency-path: backend - name: test and build backend @@ -97,7 +97,7 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25" + go-version: "1.25.12" # both go.sum files so the cache key covers the main and example modules scanned below cache-dependency-path: | backend/go.sum diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d185fdc4..8dcab20c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,7 +32,7 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25" + go-version: "1.25.12" cache-dependency-path: backend/go.sum - name: install pnpm @@ -107,7 +107,7 @@ jobs: - name: install go uses: actions/setup-go@v6 with: - go-version: "1.25" + go-version: "1.25.12" cache-dependency-path: backend/go.sum - name: install pnpm