Skip to content

build(deps): x/crypto v0.55.0 へ更新、toolchain go1.26.6 を指定 #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kwrkb merged 1 commit into from
Aug 15, 2026
Merged

build(deps): x/crypto v0.55.0 へ更新、toolchain go1.26.6 を指定 #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/).

## [Unreleased]

### Changed

- Updated dependencies: `golang.org/x/crypto` v0.54.0 → v0.55.0.
- Added `toolchain go1.26.6` to `go.mod` so local and CI builds use Go 1.26.6, which fixes several standard-library vulnerabilities reported by `govulncheck` against 1.26.5 (`net/url`, `encoding/asn1`, `crypto/tls`, `net/http`, `encoding/xml`, `html/template`, `x/net/idna`). None were reachable from this tool's code. The `go 1.26.0` directive is unchanged, so `go install` on toolchains that cannot auto-download (e.g. Termux) keeps working.

## [1.8.1] - 2026-08-12

### Changed
Expand Down
16 changes: 16 additions & 0 deletions LESSONS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,21 @@
# LESSONS

## 定期メンテナンス: stdlib 脆弱性は toolchain 行で追従する (2026-08-15)

### `go` ディレクティブは据え置き、`toolchain` 行だけを上げる
- `govulncheck` が stdlib 1.26.5 の脆弱性を複数報告した（いずれもこのツールからは到達不能）。修正は
Go 1.26.6 で、`go.mod` の何を上げるかが問題になった
- **却下した案**: (A) `go 1.26.6` に上げる — 過去に Termux（toolchain の自動ダウンロード不可）で
`go install` が失敗し 1.26.0 まで下げた経緯がある（CHANGELOG 1.x）。(B) `go.mod` を触らず CI の
`setup-go` に版を直書き — ローカルと CI で版がずれ、`go.mod` を見ても実際のビルド版が分からない
- **決め手**: `go get toolchain@go1.26.6` で `toolchain` 行を足した。`toolchain` 行は main module
としてビルドするとき（ローカル / CI）だけ効き、`go install pkg@version` の利用者には適用されない
ので Termux 互換を壊さない。ローカルは `GOTOOLCHAIN=auto` が 1.26.6 を自動取得し、`sudo` で
`/usr/local/go` を更新しなくても `make check` と `govulncheck` が新版で通った（`go version` が
モジュール内で go1.26.6 を返すことで確認）
- **覆す条件**: `toolchain` 行の版が Termux 側にも強制される挙動が確認された場合、または `go` 行の
最小版を上げる別の理由（言語機能）が出た場合は `go` 行を上げて CHANGELOG に互換性影響を明記する

## Scoop 用 PAT を 1Password 管理へ移行 (2026-08-15)

### CI シークレットの「移行先」は vault 単位の到達範囲で選ぶ
Expand Down
4 changes: 3 additions & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@ module github.com/kwrkb/ssh-pushkey

go 1.26.0

toolchain go1.26.6

require (
github.com/kevinburke/ssh_config v1.6.0
golang.org/x/crypto v0.54.0
golang.org/x/crypto v0.55.0
golang.org/x/term v0.45.0
)

Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
Expand Down