go.mod pins go 1.26.6, and CI installs exactly that through go-version-file.
Go 1.26.7 is available.
Go patch releases are security and bug fixes only, so a stale pin means every build —
including published releases — ships the standard-library vulnerabilities that patch fixed.
To resolve: set go 1.26.7 in go.mod, then confirm govulncheck ./... is clean.
Filed automatically by .github/workflows/go-toolchain.yml. Dependabot does not do this
(dependabot/dependabot-core#13520).
go.modpinsgo 1.26.6, and CI installs exactly that throughgo-version-file.Go 1.26.7 is available.
Go patch releases are security and bug fixes only, so a stale pin means every build —
including published releases — ships the standard-library vulnerabilities that patch fixed.
To resolve: set
go 1.26.7ingo.mod, then confirmgovulncheck ./...is clean.Filed automatically by
.github/workflows/go-toolchain.yml. Dependabot does not do this(dependabot/dependabot-core#13520).