From 3070cc15388f9cea858beb94408597c21c459768 Mon Sep 17 00:00:00 2001 From: Somansh Reddy Satish Date: Tue, 18 Aug 2026 06:04:26 +0000 Subject: [PATCH] chore: bump Go toolchain to 1.25.13 to clear stdlib advisories Six advisories published against go1.25.12 turned the govulncheck job red on every PR (GO-2026-5026, -5972, -6089, -6090, -6218 in the standard library, all "Fixed in: net/http@go1.25.13"). The job is not a required check, so it was failing silently rather than blocking, which is worse: a permanently red gate stops being read. Bumps go.mod and all four setup-go pins in ci.yml, plus the pins in release-stable.yml and dev-release.yml. The release workflows matter most and are easy to miss: bumping only CI would turn the gate green while shipping user binaries still linked against the vulnerable stdlib. govulncheck now reports only GO-2026-5932, the openpgp advisory the job already allowlists, so the gate passes for the reason it is meant to. Verified the toolchain change moves no user-visible surface, two independent ways: scripts/release-surface.sh reports the 2610 contract-bearing lines in gen/ identical, and dumping --help for all 289 command nodes from binaries built with 1.25.12 and 1.25.13 gives byte-identical output (same sha256). Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/dev-release.yml | 2 +- .github/workflows/release-stable.yml | 2 +- go.mod | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b372060..2670d4e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Build run: make build @@ -37,7 +37,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25.13" - uses: golangci/golangci-lint-action@v9 with: @@ -80,7 +80,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Install govulncheck run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 @@ -121,7 +121,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25.13" - uses: goreleaser/goreleaser-action@v7 with: diff --git a/.github/workflows/dev-release.yml b/.github/workflows/dev-release.yml index 134270e..947236b 100644 --- a/.github/workflows/dev-release.yml +++ b/.github/workflows/dev-release.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Run tests run: make test diff --git a/.github/workflows/release-stable.yml b/.github/workflows/release-stable.yml index d938e83..894d05e 100644 --- a/.github/workflows/release-stable.yml +++ b/.github/workflows/release-stable.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Validate version shell: bash diff --git a/go.mod b/go.mod index c24f82d..10b1945 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/heygen-com/heygen-cli -go 1.25.12 +go 1.25.13 require ( github.com/getkin/kin-openapi v0.137.0