Skip to content

chore(deps): update dependency go to 1.26 - #26

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-1.x
Open

chore(deps): update dependency go to 1.26#26
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-1.x

Conversation

@renovate

@renovate renovate Bot commented Jun 21, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Type Update Change
go uses-with minor 1.221.26

Release Notes

actions/go-versions (go)

v1.26.6: 1.26.6

Compare Source

Go 1.26.6

v1.26.5: 1.26.5

Compare Source

Go 1.26.5

v1.26.4: 1.26.4

Compare Source

Go 1.26.4

v1.26.3: 1.26.3

Compare Source

Go 1.26.3

v1.26.2: 1.26.2

Compare Source

Go 1.26.2

v1.26.1: 1.26.1

Compare Source

Go 1.26.1

v1.26.0: 1.26.0

Compare Source

Go 1.26.0

v1.25.13: 1.25.13

Compare Source

Go 1.25.13

v1.25.12: 1.25.12

Compare Source

Go 1.25.12

v1.25.11: 1.25.11

Compare Source

Go 1.25.11

v1.25.10: 1.25.10

Compare Source

Go 1.25.10

v1.25.9: 1.25.9

Compare Source

Go 1.25.9

v1.25.8: 1.25.8

Compare Source

Go 1.25.8

v1.25.7: 1.25.7

Compare Source

Go 1.25.7

v1.25.6: 1.25.6

Compare Source

Go 1.25.6

v1.25.5: 1.25.5

Compare Source

Go 1.25.5

v1.25.4: 1.25.4

Compare Source

Go 1.25.4

v1.25.3: 1.25.3

Compare Source

Go 1.25.3

v1.25.2: 1.25.2

Compare Source

Go 1.25.2

v1.25.1: 1.25.1

Compare Source

Go 1.25.1

v1.25.0: 1.25.0

Compare Source

Go 1.25.0

v1.24.13: 1.24.13

Compare Source

Go 1.24.13

v1.24.12: 1.24.12

Compare Source

Go 1.24.12

v1.24.11: 1.24.11

Compare Source

Go 1.24.11

v1.24.10: 1.24.10

Compare Source

Go 1.24.10

v1.24.9: 1.24.9

Compare Source

Go 1.24.9

v1.24.8: 1.24.8

Compare Source

Go 1.24.8

v1.24.7: 1.24.7

Compare Source

Go 1.24.7

v1.24.6: 1.24.6

Compare Source

Go 1.24.6

v1.24.5: 1.24.5

Compare Source

Go 1.24.5

v1.24.4: 1.24.4

Compare Source

Go 1.24.4

v1.24.3: 1.24.3

Compare Source

Go 1.24.3

v1.24.2: 1.24.2

Compare Source

Go 1.24.2

v1.24.1: 1.24.1

Compare Source

Go 1.24.1

v1.24.0: 1.24.0

Compare Source

Go 1.24.0

v1.23.12: 1.23.12

Compare Source

Go 1.23.12

v1.23.11: 1.23.11

Compare Source

Go 1.23.11

v1.23.10: 1.23.10

Compare Source

Go 1.23.10

v1.23.9: 1.23.9

Compare Source

Go 1.23.9

v1.23.8: 1.23.8

Compare Source

Go 1.23.8

v1.23.7: 1.23.7

Compare Source

Go 1.23.7

v1.23.6: 1.23.6

Compare Source

Go 1.23.6

v1.23.5: 1.23.5

Compare Source

Go 1.23.5

v1.23.4: 1.23.4

Compare Source

Go 1.23.4

v1.23.3: 1.23.3

Compare Source

Go 1.23.3

v1.23.2: 1.23.2

Compare Source

Go 1.23.2

v1.23.1: 1.23.1

Compare Source

Go 1.23.1

v1.23.0: 1.23.0

Compare Source

Go 1.23.0


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


Open in Devin Review

@greptile-apps

greptile-apps Bot commented Jun 21, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@changeset-bot

changeset-bot Bot commented Jun 21, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 4317fdc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@wave-bugbot

wave-bugbot Bot commented Jun 24, 2026

Copy link
Copy Markdown

🌊 WAVE BugBot — 2 finding(s)

🔴 2

  • 🔴 P0 .github/workflows/release-go.yml:25 CWE-78Unpinned action tags
    The workflow uses @v4 for actions, which is a tag that can be updated. This could potentially allow an attacker to inject malicious code if the tag is comprom
  • 🔴 P0 .github/workflows/test-go.yml:34 CWE-78Unpinned action tags
    The workflow uses @v4 for actions, which is a tag that can be updated. This could potentially allow an attacker to inject malicious code if the tag is comprom

severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune

@renovate
renovate Bot force-pushed the renovate/go-1.x branch 4 times, most recently from f42393f to e70001c Compare July 22, 2026 05:13
@renovate
renovate Bot force-pushed the renovate/go-1.x branch 2 times, most recently from d0b88c9 to 4317fdc Compare August 1, 2026 03:53
yakimoto added a commit that referenced this pull request Aug 9, 2026
Review flagged that a change raising what consumers need in order to
build the published SDK shipped with no Unreleased entry. Correct, and
the same miss I made on the sibling public repo in the same batch.

The entry states the breaking part plainly (older or pinned toolchains,
and GOTOOLCHAIN=off, hard-fail), the escape hatch (GOTOOLCHAIN=auto
handles it), why 1.25 and not 1.26 (oldest release still receiving
security fixes, widest supported consumer window), and that nothing
downstream needs more - after the bump the highest go requirement in the
whole module graph is this module itself.

It also records the distinction that makes this PR separate from #26:
setup-go installed 1.22.12 and the toolchain switched itself UP to
1.24.0 off this directive, so the workflow pin was never the operative
version. A floor that ships inside go.mod cannot be fixed by a workflow
change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@renovate
renovate Bot force-pushed the renovate/go-1.x branch from 4317fdc to 031ea8d Compare August 14, 2026 17:25

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Open in Devin Review

- uses: actions/setup-go@v5
with:
go-version: "1.22"
go-version: "1.26"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Dependency caching disabled with an outdated justification

The cache: false comment claims the module is stdlib-only with no go.sum to cache, but sdk-go/go.mod now requires github.com/ethereum/go-ethereum v1.17.3 plus a dozen indirect deps and sdk-go/go.sum exists. Disabling the module cache means every CI run re-downloads those (including heavy crypto deps like supranational/blst), which slows the gate and adds proxy-flakiness risk. Since this PR is already touching the Go toolchain config here, enabling caching (and dropping the stale comment) would be a natural follow-up.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@macroscopeapp

macroscopeapp Bot commented Aug 14, 2026

Copy link
Copy Markdown

Approvability

Verdict: Needs human review

This PR bumps Go version from 1.22 to 1.26 in CI workflows - a low-risk change. However, both modified files are owned by wave-av/sdk-owners, and Renovate is not a designated owner, so review by the code owners is appropriate.

You can customize Macroscope's approvability policy. Learn more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants