Skip to content

ci: restore green CI after upstream linter and vuln-DB drift #1006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cpcloud merged 2 commits into from
May 21, 2026
+13 −10
Merged

ci: restore green CI after upstream linter and vuln-DB drift #1006

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e6169b7
ci(lint): pin golangci-lint to v2.11.4
cpcloud May 21, 2026
790d68d
chore(deps): bump scoped Go override to 1.26.3
cpcloud May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ jobs:

- name: Run golangci-lint
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
with:
version: v2.11.4

pre-commit:
name: Pre-commit
Expand Down
21 changes: 11 additions & 10 deletions nix/overlay.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,23 +8,24 @@

_final: prev:
let
# Scoped Go 1.26.2 override for micasa and its dev tools only.
# Scoped Go 1.26.3 override for micasa and its dev tools only.
# NOT exported as go/go_1_26/buildGoModule — doing so rebuilds the
# entire transitive closure from source (VHS → Chromium → PipeWire →
# ffmpeg/gstreamer) because every Go derivation's input hash changes.
#
# 1.26.2 fixes five stdlib vulnerabilities flagged by govulncheck:
# GO-2026-4865 (html/template JsBraceDepth XSS)
# GO-2026-4866 (crypto/x509 excludedSubtrees auth bypass)
# GO-2026-4870 (crypto/tls KeyUpdate DoS)
# GO-2026-4946 (crypto/x509 inefficient policy validation)
# GO-2026-4947 (crypto/x509 unexpected work during chain building)
# Drop this override once nixpkgs picks up Go 1.26.2.
# 1.26.3 fixes six stdlib vulnerabilities flagged by govulncheck:
# GO-2026-4918 (net/http HTTP/2 SETTINGS frame infinite loop)
# GO-2026-4971 (net Dial/LookupPort panic on NUL input on Windows)
# GO-2026-4977 (net/mail consumePhrase DoS)
# GO-2026-4980 (html/template empty <script type=> escape bug)
# GO-2026-4982 (html/template <meta> URL escape gap)
# GO-2026-4986 (net/mail parsing CPU/memory exhaustion)
# Drop this override once nixpkgs picks up Go 1.26.3.
patchedGo = prev.go_1_26.overrideAttrs (_: rec {
version = "1.26.2";
version = "1.26.3";
src = prev.fetchurl {
url = "https://go.dev/dl/go${version}.src.tar.gz";
hash = "sha256-LpHrtpR6lulDb7KzkmqIAu/mOm03Xf/sT4Kqnb1v1Ds=";
hash = "sha256-HGRoddCqh5kTMYTtV895/yS97+jIggRwYCqdPW2Rkrg=";
};
});
in
Expand Down
Loading