From 353b8f5a169cd47676316bccbd8db2fcc7289524 Mon Sep 17 00:00:00 2001 From: claude Date: Tue, 11 Aug 2026 12:27:10 +0400 Subject: [PATCH] Take the 19 standard library advisories off the box (V-682) govulncheck found 20 reachable advisories on 2026-08-10: 19 in the standard library and one in x/text. Go 1.25.12 closes the 19. The reachable traces that mattered are mavweb's HTML template escaping and the mavgpud proxy's TLS, both of which face the LAN. deps/ is gitignored and make deps-go builds the toolchain, so the bump is the version, its checksum and the go directive. Nothing is vendored by this commit. x/text stays at 0.14.0 (owner's call, 2026-08-11). Its one advisory is reached only through the ONNX embedder normalizing his own text, so nothing hostile arrives there, and 0.39.0 regenerates the Unicode tables for 41,385 changed lines against a 300-line pre-commit cap that exempts only markdown. The bump is worth doing when vendor/ is exempt from the guard, not before. No govulncheck make target either: it would fail on the x/text finding from the day it landed, and a gate that is red on arrival teaches people to skip it. make fmt-check, make vet, make build and make test pass on 1.25.12, 65 packages ok. The four TestONNX measurements pass in 29.6s. --- Makefile | 4 ++-- go.mod | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index c6ac993..171c265 100644 --- a/Makefile +++ b/Makefile @@ -4,7 +4,7 @@ # `test` below fail on the two packages that have no test files. deps-go builds # the missing tools in, so the vendored tree is self-sufficient. Keep the version # here in step with the `go` directive in go.mod. -GO_VERSION := 1.25.5 +GO_VERSION := 1.25.12 GO := $(shell pwd)/deps/go/go/bin/go export GOTOOLCHAIN := local GOFLAGS := @@ -73,7 +73,7 @@ run-web: build-web # builds them on demand, but `go test -coverprofile` calls covdata through # base.Tool(), which only stats pkg/tool and exits. So build them in once here. GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz -GO_SHA256 := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b +GO_SHA256 := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1 deps-go: deps-sentinel @mkdir -p deps/go cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)' diff --git a/go.mod b/go.mod index d6f5a10..41ad514 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/kami/maven -go 1.25.5 +go 1.25.12 require ( github.com/coder/websocket v1.8.12