Build and scan with Go 1.26.10

govulncheck started failing CI on GO-2026-6809, a crypto/x509 flaw in the standard library that is fixed in 1.26.10 and reachable through http.Server.ListenAndServe. golang:1.26.9 is what ci.yaml, release.yaml and the Dockerfile build with, so all five pins move together: the scan and the shipped binary must agree on the toolchain, as in 3173abf. No code change; go.mod still says go 1.25.9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
2026-10-21 21:55:04 +02:00
parent 12535e0e9a
commit 94c394e8f1
3 changed files with 5 additions and 5 deletions
@@ -4,7 +4,7 @@
 # in per platform. The CI runner has no binfmt registration and no way to get one (the
 # JS action that used to install it cannot run there), so this is not just an
 # optimisation -- it is what makes the arm64 image buildable at all.
-FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download