build: rebuild on Go 1.26.10 and x/net v0.60.0 (CVE-2026-78667, -78669, -97031)

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
-        go: ['1.26']
+        go: ['1.26.10']
 
     steps:
       - name: Checkout code
@@ -74,13 +74,16 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.6'
+          go-version: '1.26.10'
           cache: true
 
-      # Pinned to the patch, not the minor: `1.26` resolved to 1.26.5 while the
-      # advisories below were fixed in 1.26.6, so the scan would have passed on
-      # a toolchain that still shipped them. Bump this when govulncheck fails
-      # on the standard library -- that is the gate doing its job.
+      # Pinned to the patch, not the minor: a floating `1.26` resolves to
+      # whatever the runner has that day (it shipped 1.26.8 into v3.8.2, which
+      # still carried CVE-2026-78667, -78669 and -97031), so the scan could
+      # pass on a toolchain that still shipped the advisories below. Every
+      # go-version in this repo is pinned to the same patch as the toolchain
+      # line in go.mod. Bump them together when govulncheck fails on the
+      # standard library -- that is the gate doing its job.
       # Known-vulnerable dependencies, and the standard library this is built
       # against. Nothing in CI reported either before.
       - name: Run govulncheck
@@ -105,7 +108,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.26.10'
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
@@ -126,7 +129,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.26.10'
 
       # Validates configs/examples/*.yaml against the real schema with
       # `check-config`. These files back the documented examples, so a config
@@ -148,7 +151,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.26.10'
 
       - name: Build all platforms
         run: make build-all

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26'
+          go-version: '1.26.10'
 
       - name: Get version from tag
         id: version

CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **Rebuilt against a patched Go toolchain and a patched `golang.org/x/net`.**
+  No behaviour change: the same code as 3.8.2. The 3.8.2 binaries were built by
+  a floating `go-version: '1.26'`, which resolved to 1.26.8 on the day of the
+  release and carried three denial-of-service advisories in the standard
+  library — CVE-2026-78667 (`net/http`, crafted HTTP `Range` headers),
+  CVE-2026-78669 (`net/http2`, excessive HTTP/2 SETTINGS frames) and
+  CVE-2026-97031 (`crypto/tls`, multiple ECH outer extension references) — and
+  the vendored `golang.org/x/net` v0.58.0 carried CVE-2026-78669 a second time
+  in its own HTTP/2 implementation. cbox-init serves HTTP on all three of the
+  metrics, readiness and management ports, so none of these were dead code.
+  The toolchain is pinned to 1.26.10 and `golang.org/x/net` to v0.60.0, and
+  every `go-version` in CI and in the release workflow is pinned to the same
+  patch, so the toolchain that builds a release is the one the gate scanned
+  rather than whatever the runner resolves that day.
+
 ## [3.8.2] - 2026-10-08
 
 ### Fixed

go.mod

@@ -3,11 +3,14 @@ module github.com/cboxdk/init
 go 1.26.0
 
 // Pinned to the patch the supply-chain gate requires: govulncheck flags
-// standard-library advisories fixed in 1.26.6, so a local build on an older
-// 1.26.x would fail `make check` where CI (which pins 1.26.6) passes. Bump this
-// in lockstep with the go-version in .github/workflows/ci.yml when the gate
-// next fails on the standard library.
-toolchain go1.26.6
+// standard-library advisories fixed in 1.26.10 (CVE-2026-78667 net/http,
+// CVE-2026-78669 net/http2, CVE-2026-97031 crypto/tls), so a local build on an
+// older 1.26.x would fail `make check` where CI (which pins 1.26.10) passes.
+// Bump this in lockstep with the go-version in .github/workflows/ci.yml and
+// .github/workflows/release.yml when the gate next fails on the standard
+// library -- the published binaries record the toolchain that built them, so
+// the pin is what keeps a release scannable and auditable.
+toolchain go1.26.10
 
 require (
 	github.com/cboxdk/fpm-tune v1.3.0
@@ -27,7 +30,7 @@ require (
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0
 	go.opentelemetry.io/otel/sdk v1.46.0
 	go.opentelemetry.io/otel/trace v1.46.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/sys v0.48.0
 	google.golang.org/grpc v1.83.2
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -78,8 +81,8 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
 	go.opentelemetry.io/otel/metric v1.46.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
-	golang.org/x/net v0.58.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect

go.sum

@@ -157,16 +157,16 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=