Repository navigation
Build with Go 1.26.10 and update nix flake and plugin version for v0.15.1 - #932
Conversation
The v0.15.0 release run failed its govulncheck step on GO-2026-6809, crypto/x509 "Distrust compromised intermediate certificates", found in the Go 1.26.9 standard library and fixed in 1.26.10. v0.15.0 never published; this ships as v0.15.1. As with the 1.26.9 bump, this is the toolchain line, not the go line. setup-go reads the toolchain directive, so every CI and release job builds and scans with 1.26.10, and a local go older than that switches to it. The go line stays the minimum that builds the module, since the flake builds with nixpkgs' Go under GOTOOLCHAIN=local.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approved
The four narrow updates are consistent with the release workflow, with no unresolved findings.
No open issues 🎉
What changed in this PR
Prepares v0.15.1 after the unpublished v0.15.0 release failed its vulnerability check.
Changes:
- Updates the Go toolchain to 1.26.10 for the reported
crypto/x509security fix. - Aligns Nix and both plugin versions at 0.15.1, retaining the existing vendor hash.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
nix/package.nix |
Bumps package version to 0.15.1. |
go.mod |
Selects Go toolchain 1.26.10. |
.codex-plugin/plugin.json |
Stamps Codex plugin version 0.15.1. |
.claude-plugin/plugin.json |
Stamps Claude plugin version 0.15.1. |
Review effort: Balanced
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 04b6358ead
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Review threads: 0 resolved; 1 open for a decision. |
The flake builds with nixpkgs go_1_26 under GOTOOLCHAIN=local, not the go.mod toolchain line, and the pinned nixpkgs carried Go 1.26.7. A Nix-built binary therefore missed the eleven standard-library advisories fixed in 1.26.9 as well as GO-2026-6809. nixpkgs-unstable has Go 1.26.9 but not yet 1.26.10, so this closes the eleven and leaves GO-2026-6809 for the Nix build only. flake.lock moves again in its own change once nixpkgs-unstable carries 1.26.10; Nix installs build from main, so that needs no new tag. vendorHash is unchanged, and the flake builds a 0.15.1 binary that reports go1.26.9.
|
@codex review |
Today's nixpkgs-unstable removed ruby_3_3, which the dev shell pins in step with .mise.toml and CI's setup-ruby. Moving Ruby to 3.4 everywhere and the flake to a Go 1.26.10 nixpkgs goes in its own PR after the release; Nix installs build from main, so they pick it up without a tag.
|
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Release metadata for v0.15.1. v0.15.0 never published: its release run failed "Test before release" when govulncheck found GO-2026-6809 (crypto/x509, "Distrust compromised intermediate certificates") in Go 1.26.9, fixed in 1.26.10, and its tag was deleted. v0.15.1 ships what v0.15.0 would have, plus the toolchain bump.
go.mod:toolchain go1.26.9→go1.26.10. setup-go reads the toolchain line, so every CI and release job builds and scans with 1.26.10. Thegoline stays 1.26.7, and no other file pins 1.26.9.nix/package.nixversion 0.15.0 → 0.15.1, fromscripts/update-nix-flake.sh 0.15.1. The toolchain line doesn't change the vendored modules, sovendorHashstays, and the script's Nix build succeeded with it..claude-plugin/plugin.jsonand.codex-plugin/plugin.jsonstamped 0.15.1 byscripts/stamp-plugin-version.shandscripts/stamp-codex-plugin-version.sh.govulncheck -tags dev ./...passes under 1.26.10, and still reports GO-2026-6809 when forced back to 1.26.9. As with #930, the v0.15.1 tag goes on this PR's merge commit:make release VERSION=0.15.1from main then finds the metadata in place and only creates and pushes the tag.Summary by cubic
Prepares the v0.15.1 release metadata; v0.15.0 never published because its release run failed govulncheck on GO-2026-6809, a
crypto/x509vulnerability in Go 1.26.9, fixed in 1.26.10.go.modtoolchain line to go1.26.10; thegoline stays 1.26.7.nix/package.nixand stamps.claude-plugin/plugin.jsonand.codex-plugin/plugin.jsonto version 0.15.1.flake.lockwhere v0.14.0 had it: today's nixpkgs-unstable droppedruby_3_3, which the dev shell pins, so the flake moves to a Go 1.26.10 nixpkgs in a separate PR after the release; Nix installs build from main and pick it up without a tag.Written for commit e24e17c. Summary will update on new commits.