From dcce96c08d5586b0b70c82fc8249c3379f3a5c9f Mon Sep 17 00:00:00 2001 From: Giteabot Date: Fri, 6 Feb 2026 23:00:52 +0800 Subject: [PATCH] [SECURITY] fix: Adjust the toolchain version (#36537) (#36542) Backport #36537 by @ZPascal # Summary: - Adjust the toolchain version to fix the security issues ```log Vulnerability #1: GO-2026-4337 Unexpected session resumption in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4337 Standard library Found in: crypto/tls@go1.25.6 Fixed in: crypto/tls@go1.25.7 Example traces found: ``` Signed-off-by: Pascal Zimmermann Co-authored-by: Pascal Zimmermann --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index b9a12c0a8e..2d60239a54 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module code.gitea.io/gitea go 1.25.0 -toolchain go1.25.6 +toolchain go1.25.7 // rfc5280 said: "The serial number is an integer assigned by the CA to each certificate." // But some CAs use negative serial number, just relax the check. related: