basepeak-ai/go-gptscript
Watch
6
0
Fork
You've already forked go-gptscript
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(deps): bump Go to 1.26.9 to clear stdlib vulns #5

Merged
thklein merged 1 commit from fix/deps-security into main 2026-10-18 10:47:49 +00:00
Conversation 0 Commits 1 Files changed 3 +11 -28
thklein commented 2026-10-18 10:34:03 +00:00
Owner
Copy link

Summary

Clear the known vulnerabilities reported by govulncheck.

  • go directive 1.25.3 -> 1.26.9 (latest 1.26 patch, same as gptscript). CI picks it up through setup-go go-version-file: go.mod, so the workflow itself needs no change.
  • github.com/google/jsonschema-go v0.4.2 -> v0.4.3 (patch)
  • github.com/stretchr/testify v1.10.0 -> v1.12.1 (test only). go mod tidy swaps the indirect gopkg.in/yaml.v3 for go.yaml.in/yaml/v3 and drops go-spew, go-difflib and check.v1 from go.mod.
  • Makefile GOLANGCI_LINT_VERSION v2.6.1 -> v2.12.2. v2.6.1 is built with go1.25 and refuses a go1.26 module ("the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.9)").

The gptscript binary version used in CI (v0.9.10) is unchanged.

Audit

Before (main) After
govulncheck ./... reachable 23 (all stdlib) 0 ("No vulnerabilities found.")
imported but not called 7 0
required modules, not imported 11 0

Verification

  • GOTOOLCHAIN=go1.26.9 make validate (tidy + golangci-lint v2.12.2): clean, 0 issues
  • go build ./..., go vet ./...: pass
  • make test needs a gptscript binary and provider keys (the CI step only runs when OPENAI_API_KEY is set), so it was not run locally.
## Summary Clear the known vulnerabilities reported by `govulncheck`. - `go` directive 1.25.3 -> **1.26.9** (latest 1.26 patch, same as gptscript). CI picks it up through `setup-go` `go-version-file: go.mod`, so the workflow itself needs no change. - `github.com/google/jsonschema-go` v0.4.2 -> v0.4.3 (patch) - `github.com/stretchr/testify` v1.10.0 -> v1.12.1 (test only). `go mod tidy` swaps the indirect `gopkg.in/yaml.v3` for `go.yaml.in/yaml/v3` and drops `go-spew`, `go-difflib` and `check.v1` from go.mod. - Makefile `GOLANGCI_LINT_VERSION` v2.6.1 -> v2.12.2. v2.6.1 is built with go1.25 and refuses a go1.26 module ("the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.9)"). The gptscript binary version used in CI (v0.9.10) is unchanged. ## Audit | | Before (main) | After | |---|---|---| | `govulncheck ./...` reachable | 23 (all stdlib) | **0** ("No vulnerabilities found.") | | imported but not called | 7 | 0 | | required modules, not imported | 11 | 0 | ## Verification - `GOTOOLCHAIN=go1.26.9 make validate` (tidy + golangci-lint v2.12.2): clean, 0 issues - `go build ./...`, `go vet ./...`: pass - `make test` needs a gptscript binary and provider keys (the CI step only runs when `OPENAI_API_KEY` is set), so it was not run locally.
fix(deps): bump Go to 1.26.9 to clear stdlib vulns
All checks were successful
test / test (pull_request) Successful in 15s
Details
ce29de1039
 
govulncheck reported 23 reachable standard library vulnerabilities
with go 1.25.3. Raise the go directive to 1.26.9, matching gptscript,
and bump jsonschema-go to v0.4.3 and testify to v1.12.1.

golangci-lint v2.6.1 is built with go1.25 and refuses to lint a go1.26
module, so move the Makefile pin to v2.12.2.
thklein deleted branch fix/deps-security 2026-10-18 10:47:49 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
basepeak-ai/go-gptscript!5
No description provided.