Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR aims to address GO-2026-4337 (crypto/tls unexpected session resumption) by raising the project’s minimum Go toolchain requirement.
Changes:
- Bump the
goversion directive ingo.modfrom1.25.1to1.25.7.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
go.mod
Outdated
| module github.com/jpillora/chisel | ||
|
|
||
| go 1.25.1 | ||
| go 1.25.7 |
There was a problem hiding this comment.
The go directive is primarily a language/version compatibility marker and generally shouldn’t be used to pin a specific patch release for security fixes. If the intent is to require Go 1.25.7 (or later) for GO-2026-4337, consider setting go 1.25 and adding a toolchain go1.25.7 directive (or otherwise documenting/enforcing the required toolchain in CI/release), so consumers don’t build with an older patched toolchain inadvertently.
| go 1.25.7 | |
| go 1.25 | |
| toolchain go1.25.7 |
Separates language compatibility (go 1.25) from toolchain requirement (toolchain go1.25.7) per Copilot review suggestion. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
Summary
golang.org/x/*dependencies to latest versionscrypto/tlsvulnerability GO-2026-4337 (unexpected session resumption)govulncheckreports zero vulnerabilities after these changesTest plan
go test ./...passesgovulncheck ./...reports no vulnerabilities🤖 Generated with Claude Code