harivansh-afk opened issue getcompanion-ai/computer-host#5

harivansh-afk
Thu, 09 Apr 2026 04:29:02 +0000

5#should move off Go 1.26.1 due to reachable stdlib vulns#

A govulncheck pass against the current module and toolchain reports standard-library vulnerabilities in the Go version this repo targets today.

What I hit locally:

go.mod currently declares go 1.26.1

govulncheck ./... reported the following reachable stdlib advisories:

GO-2026-4947 in crypto/x509, fixed in Go 1.26.2

GO-2026-4946 in crypto/x509, fixed in Go 1.26.2

GO-2026-4870 in crypto/tls, fixed in Go 1.26.2

GO-2026-4866 in crypto/x509, fixed in Go 1.26.2

Representative traces from the scan reached:

main.go:71

internal/firecracker/api.go:230

Expected behavior:

The public host daemon repo should target a Go toolchain version with these standard-library fixes.

Suggested follow-up:

Bump the declared Go version and CI/runtime toolchain to 1.26.2 or newer.

Add govulncheck to the validation path so future stdlib advisories are caught quickly.