[cthach]

Resolves 13 Go vulnerabilities found by govulncheck just by updating Go from v1.26.4 to v1.26.10.

I used GOTOOLCHAIN=go1.26.4 go run golang.org/x/vuln/cmd/govulncheck@latest ./... to find the vulnerabilities, followed up with GOTOOLCHAIN=go1.26.10 go run golang.org/x/vuln/cmd/govulncheck@latest ./... after.

Test and build all pass locally. I also verified the Go version that the container builds the binary with is v1.26.10.

AI?: NO AI was used at any point in time to write this PR. I wrote and reviewed all lines by hand.

Before updating

Vulnerability #1: GO-2026-6809
Vulnerability #2: GO-2026-6617
Vulnerability #3: GO-2026-6613
Vulnerability #4: GO-2026-6612
Vulnerability #5: GO-2026-6611
Vulnerability #6: GO-2026-6610
Vulnerability #7: GO-2026-6609
Vulnerability #8: GO-2026-6608
Vulnerability #9: GO-2026-6607
Vulnerability #10: GO-2026-6605
Vulnerability #11: GO-2026-6603
Vulnerability #12: GO-2026-6218
Vulnerability #13: GO-2026-6090
Vulnerability #14: GO-2026-6089
Vulnerability #15: GO-2026-6088
Vulnerability #16: GO-2026-5972
Vulnerability #17: GO-2026-5856
Vulnerability #18: GO-2026-5026
Vulnerability #19: GO-2026-4887
Vulnerability #20: GO-2026-4883

After updating

Vulnerability #1: GO-2026-6617
Vulnerability #2: GO-2026-6612
Vulnerability #3: GO-2026-6611
Vulnerability #4: GO-2026-6610
Vulnerability #5: GO-2026-6603
Vulnerability #6: GO-2026-4887
Vulnerability #7: GO-2026-4883

Summary by CodeRabbit

• Maintenance
  • Updated the Go version used for project builds and listed in contribution guidance to 1.26.10, keeping build requirements consistent across CI, nightly builds, and releases.
  • Updated the networking component to a newer version.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: tinyauthapp/tinyauth
• Branch: main
• File: .coderabbit.yaml
• Commit: 35bdfa8
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 853f7d57-cbf0-41e4-b1b1-cbf7407e11ce

Commits

Reviewing files that changed from the base of the PR and between 9a89bae and 4eb3735.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

The Go version requirement changes from 1.26.4 to 1.26.10 in the module directive, CI and build workflows, and contributor documentation. The golang.org/x/net dependency is upgraded from v0.59.0 to v0.60.0.

Changes: Go Toolchain Version

Layer / File(s)	Summary
Align Go version requirements go.mod, .github/workflows/*.yml, CONTRIBUTING.md	The module directive, workflow Go version constraints, and documented minimum Go version change to 1.26.10. golang.org/x/net changes from v0.59.0 to v0.60.0.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: steveiliop56

Merge Risk: Minimal · up to 4eb37

The version and dependency updates present no identified merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating the Go toolchain to v1.26.10.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn