Repository navigation
fix(security): build releases with Go 1.27.3 - #13
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 023ca38e65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| var ( | ||
| version = "0.1.7" | ||
| version = "0.1.8" |
There was a problem hiding this comment.
When this version bump is used to ship the security release, both workflow commands in docs/releasing.md still pass version=0.1.7 (lines 38 and 78). Because that input selects the artifact version and release tag, the dry run rehearses mislabeled 0.1.7 artifacts and the live run targets the already-published v0.1.7 rather than creating v0.1.8, preventing operators who follow the guide from publishing this fix.
Useful? React with 👍 / 👎.
1 participant
GO-2026-6809 is symbol-reachable with Go 1.27.2. Select Go 1.27.3 for source, CI, release and Docker builds where applicable, while preserving the existing Go language minimum and compatibility tests. Prepare patch release 0.1.8 with the security changelog entry and matching version metadata.
Before:
govulncheck ./...with Go 1.27.2 reports GO-2026-6809:Vulnerability #1: GO-2026-6809. After: the same scan with Go 1.27.3 reports no reachable vulnerabilities.Validation: local build and quick tests passed; workflow syntax passed (the local actionlint catalog requires ignoring the existing custom
xcode-27runner label); independent P0–P2 review found no actionable issues. Release dry run, signed tag and artifact verification follow after exact-head CI.