From 66821349b1e2a9ae37a5616d4a24a9634c3c6bd7 Mon Sep 17 00:00:00 2001 From: Marc Nuri Date: Sat, 31 Oct 2026 17:08:49 +0100 Subject: [PATCH] chore(deps): bump Go toolchain to 1.26.10 Go 1.26.7 is affected by 14 standard library vulnerabilities fixed in 1.26.9 and 1.26.10 (net/http HTTP/1 and HTTP/2, crypto/tls, crypto/x509, html/template, net/textproto, os on Windows). Bump GO_VERSION in the build, release and snapshot workflows and the Makefile default (which also selects the xgo image) ahead of v0.0.22. Also refresh the stale Helm and Go versions in AGENTS.md. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Marc Nuri --- .github/workflows/build.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/snapshots.yml | 2 +- AGENTS.md | 4 ++-- Makefile | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 441175a..d60acbe 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -7,7 +7,7 @@ on: pull_request: env: - GO_VERSION: 1.26.7 + GO_VERSION: 1.26.10 jobs: build-all: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 288bd48..44f0ea8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,7 +6,7 @@ on: - 'v*' env: - GO_VERSION: 1.26.7 + GO_VERSION: 1.26.10 jobs: release: diff --git a/.github/workflows/snapshots.yml b/.github/workflows/snapshots.yml index a30520e..3ad30b2 100644 --- a/.github/workflows/snapshots.yml +++ b/.github/workflows/snapshots.yml @@ -6,7 +6,7 @@ on: - cron: '0 2 * * *' # Every day at 2am env: - GO_VERSION: 1.26.7 + GO_VERSION: 1.26.10 jobs: snapshots: diff --git a/AGENTS.md b/AGENTS.md index 1d23ed4..6f48b93 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -6,9 +6,9 @@ This file is the primary context for AI coding agents (Claude Code, Copilot, etc A Java client library for Helm with no external CLI dependency. The Helm Go SDK (`helm.sh/helm/v3`) is compiled to a per-platform shared library via CGO and loaded from Java with JNA. The public Java API is a fluent builder that mirrors Helm CLI verbs: `install`, `upgrade`, `uninstall`, `template`, `package`, `lint`, `repo`, `registry`, `search`, `show`, `status`, `history`, `get` (values), `test`, `list`, `dependency`, `push`, `version`, `create`. -- Helm SDK version: tracked by `native/go.mod` (currently `helm.sh/helm/v3 v3.21.0`). +- Helm SDK version: tracked by `native/go.mod` (currently `helm.sh/helm/v3 v3.22.1`). - Java baseline: source/target 1.8. Tests run on 8 (Linux CI) or 11 (macOS/Windows CI, because macos-latest dropped 8). -- Go baseline: pinned in `native/go.mod` and `.github/workflows/build.yml` (`GO_VERSION`); currently `1.25.10`. +- Go baseline: minimum language version is the `go` directive in `native/go.mod` (currently `1.26.0`); the toolchain used for builds is pinned as `GO_VERSION` in `.github/workflows/{build,release,snapshots}.yml` and the `Makefile` default (currently `1.26.10`). Keep all four in sync. ## Repository layout diff --git a/Makefile b/Makefile index 40abba4..7987ef3 100644 --- a/Makefile +++ b/Makefile @@ -9,7 +9,7 @@ CGO_ENABLED = 1 # The xgo image must ship a Go >= the `go` directive in native/go.mod. Otherwise the # container silently downloads a newer toolchain whose linker is incompatible with # that image's mingw-w64 binutils, and the Windows DLL fails to link. -GO_VERSION ?= 1.26.7 +GO_VERSION ?= 1.26.10 XGO_IMAGE = ghcr.io/techknowlogick/xgo:go-$(GO_VERSION) LD_FLAGS = -s -w COMMON_BUILD_ARGS = -ldflags "$(LD_FLAGS)" -buildmode=c-shared