The Go vulnerability check job in the Nightly workflow has failed on every run since 2026-07-09. It was green through 2026-07-08.
Vulnerability #1: GO-2026-5856
Found in: crypto/tls@go1.26.4
Fixed in: crypto/tls@go1.26.5
Your code is affected by 1 vulnerability from the Go standard library.
That is CVE-2026-42505, an Encrypted Client Hello privacy leak in crypto/tls, published 2026-07-07, which lines up with when the job went red. govulncheck reports five reachable traces, including server.ListenAndServe (internal/server/server.go:135) and database.InitDB (internal/database/database.go:361).
The job installs Go with go-version-file: .go-version, and that file pins 1.26.4. Bumping it to 1.26.5 clears the check. I ran govulncheck against c193a14 locally to confirm: exit 3 on go1.26.4, exit 0 on go1.26.5, with no remaining called vulnerabilities.
One thing that may be worth a look separately: dependabot updates go.mod and go.sum but not .go-version, so Go toolchain security fixes have no automated path in. The last bump to that file was 2026-06-09.
Happy to send a PR for the version bump.
The
Go vulnerability checkjob in theNightlyworkflow has failed on every run since 2026-07-09. It was green through 2026-07-08.That is CVE-2026-42505, an Encrypted Client Hello privacy leak in
crypto/tls, published 2026-07-07, which lines up with when the job went red. govulncheck reports five reachable traces, includingserver.ListenAndServe(internal/server/server.go:135) anddatabase.InitDB(internal/database/database.go:361).The job installs Go with
go-version-file: .go-version, and that file pins1.26.4. Bumping it to1.26.5clears the check. I ran govulncheck againstc193a14locally to confirm: exit 3 on go1.26.4, exit 0 on go1.26.5, with no remaining called vulnerabilities.One thing that may be worth a look separately: dependabot updates
go.modandgo.sumbut not.go-version, so Go toolchain security fixes have no automated path in. The last bump to that file was 2026-06-09.Happy to send a PR for the version bump.