From 3e6b9e5312ef1c64ebcb89efde3b6da2c677c81a Mon Sep 17 00:00:00 2001 From: Giteabot Date: Thu, 9 Apr 2026 00:27:32 +0800 Subject: [PATCH] Bump min go version to 1.26.2 (#37139) (#37143) Backport #37139 by @silverwind Update Go from 1.26.1 to 1.26.2 to fix 6 stdlib vulnerabilities: - GO-2026-4947: `crypto/x509` chain building - GO-2026-4946: `crypto/x509` policy validation - GO-2026-4870: `crypto/tls` KeyUpdate DoS - GO-2026-4869: `archive/tar` unbounded allocation - GO-2026-4866: `crypto/x509` name constraints bypass - GO-2026-4865: `html/template` XSS Co-authored-by: silverwind Co-authored-by: Claude (Opus 4.6) --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 22de5ba1ba..0bccbe87b9 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module code.gitea.io/gitea -go 1.26.1 +go 1.26.2 // rfc5280 said: "The serial number is an integer assigned by the CA to each certificate." // But some CAs use negative serial number, just relax the check. related: