mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-26 13:39:47 +00:00
rcourtman
f42b2d7e88
govulncheck on the pinned Go 1.26.8 reports twelve reachable standard library vulnerabilities in Pulse (net/http, crypto/tls, html/template, os, net/textproto), published 2026-10-08 and fixed in Go 1.26.9, plus x/net advisories fixed in v0.60.0. With both bumped, govulncheck v1.1.4 and v1.7.0 report no affecting vulnerabilities. Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged it. The private Enterprise test job did: once the scan finds reachable advisories it exceeds the 4 GiB CI VM and the guest kernel kills it, which has failed every Enterprise pair check since 2026-10-08. All release builders and local toolchain guards move together, as for 1.26.8. Only x/net changes in the module graph; the modules are deliberately not re-tidied. Checked on pulse-dev against this exact tree: the readonly dependency graph and the full build pass, the four installtests that pin the toolchain digests pass, and the root pair diagnostic tests pass.