fix(deps): update Go to 1.26.9, cobra and logrus #1

Merged

thklein merged 1 commit from fix/deps-security into main

2026-10-18 10:24:18 +00:00

thklein commented

2026-10-18 08:48:08 +00:00

Owner

Raise the go directive from 1.26.3 to 1.26.9 (latest go1.26 patch release), which fixes all reachable stdlib findings
Bump github.com/spf13/cobra v1.7.0 → v1.10.2 and github.com/sirupsen/logrus v1.9.3 → v1.10.2 (low-risk minor updates); indirect: pflag v1.0.9, golang.org/x/sys v0.49.0, testify v1.12.1

govulncheck

	Reachable
Before (go 1.26.3)	13 (all Go stdlib)
After (go 1.26.9)	0 (No vulnerabilities found)

Verification (local, go1.26.9)

go mod tidy, go build ./..., go vet ./..., go test ./... all pass.

This repository has no CI workflow (no .forgejo/workflows or .github/workflows), so there are no CI checks on this PR; the results above are from a local run.

Note for consumers: modules requiring this version will need go >= 1.26.9 (gptscript is currently on go 1.26.3 and will be raised when it picks this up).

- Raise the `go` directive from `1.26.3` to `1.26.9` (latest go1.26 patch release), which fixes all reachable stdlib findings - Bump `github.com/spf13/cobra` v1.7.0 → v1.10.2 and `github.com/sirupsen/logrus` v1.9.3 → v1.10.2 (low-risk minor updates); indirect: pflag v1.0.9, golang.org/x/sys v0.49.0, testify v1.12.1 ## govulncheck | | Reachable | |---|---| | Before (go 1.26.3) | 13 (all Go stdlib) | | After (go 1.26.9) | 0 (No vulnerabilities found) | ## Verification (local, go1.26.9) `go mod tidy`, `go build ./...`, `go vet ./...`, `go test ./...` all pass. This repository has no CI workflow (no `.forgejo/workflows` or `.github/workflows`), so there are no CI checks on this PR; the results above are from a local run. Note for consumers: modules requiring this version will need `go >= 1.26.9` (gptscript is currently on `go 1.26.3` and will be raised when it picks this up).

thklein added 1 commit

2026-10-18 08:48:08 +00:00

fix(deps): update Go to 1.26.9, cobra and logrus 5811f512b3