Repository navigation
Update Go and network dependencies - #190
Merged
Merged
Conversation
Use the supported Go 1.26.10 toolchain and golang.org/x/net 0.60.0, with the transitive versions selected by its module graph. Align the local Mise toolchain with the version used by CI and releases. Tracking: StackVista/cve-reporter#101
The required online Zizmor audit fails because the main branch in the shared Renovate repository has advanced beyond these fixed, untagged action revisions. Remove the stale branch annotations without changing either action pin or any workflow behavior. Parsed YAML is identical, and Zizmor 1.31.1 passes with online audits enabled.
LouisLotter
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Build the SUSE Observability CLI with Go 1.26.10 and
golang.org/x/net0.60.0, including its required transitive updates, and align the local Mise pin. The supported Go 1.26 line works with the existing linter. Remove two stale Renovate branch annotations that blocked Zizmor; action pins and parsed workflow behavior are identical.Tracks https://github.com/StackVista/cve-reporter/issues/101. PR CI passes tests, lint, workflow security, license and GoReleaser checks. Native AMD64/ARM64 validation passes timezone/JSON and TLS controls, with zero vulnerability and secret findings. Private evidence includes inventories, affected-image controls and compilation of all five release targets at head
5128b804.After review and merge, a human must publish a release newer than
v3.9.2and adopt it in the dev chart. Delivery confirmation requires a later complete dev scan.