build(deps): update dependencies and raise the Go floor to 1.26.9 (#1056)

* build(deps): update dependencies and raise the Go floor to 1.26.9 for new stdlib advisories

* ci: pin the floor Go legs to 1.26.9

Author: nao1215

.github/workflows/golangci-lint.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.26.9"
 
       - name: Run golangci-lint as an enforced gate
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0

.github/workflows/govulncheck.yml

@@ -37,7 +37,7 @@ jobs:
       fail-fast: false
       matrix:
         go:
-          - "1.26.6"
+          - "1.26.9"
           - "stable"
 
     steps:

.github/workflows/release.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: Install Syft (SBOM generator)
-        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
       - name: Run GoReleaser
         id: run-goreleaser
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3

.github/workflows/reviewdog.yml

@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: golangci-lint
-        uses: reviewdog/action-golangci-lint@c76cceaaab89abe74e649d2e34c6c9adc26662d2 # v2.10.0
+        uses: reviewdog/action-golangci-lint@284129a3ac23bc5d8ac1522e0b6511df74a8836d # v2.10.2
         with:
           reporter: github-pr-review
           level: warning
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: reviewdog/action-actionlint@2085657ab2c7f48c58edcc767fba576f63bea76b # v1.77.0
+      - uses: reviewdog/action-actionlint@1758727be30241166609dad4c97588b6ad411f32 # v1.79.1
         with:
           reporter: github-pr-review
           level: warning

.github/workflows/unit_test.yml

@@ -27,7 +27,7 @@ jobs:
         # than a pinned newest: a pin stops being the newest the day after it is
         # written, and "1" would not do either, since setup-go resolves it from
         # a manifest that lags a fresh Go release.
-        go: ["1.26", "stable"]
+        go: ["1.26.9", "stable"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Building from source now needs Go 1.26.9 or later (was 1.26.6). Go 1.26.9 fixes standard library advisories reachable from mimixbox in `net/http`, `mime/multipart` and `crypto/tls` (GO-2026-6603, GO-2026-6605, GO-2026-6607 to GO-2026-6613 and GO-2026-6617). Prebuilt binaries are unaffected. The integration-test image builds with `golang:1.27-bookworm`. Dependencies: modernc.org/sqlite v1.60.1, klauspost/compress v1.20.1.
+
 ## [0.42.5] - 2026-09-28
 
 ### Fixed

CONTRIBUTING.md

@@ -4,7 +4,7 @@ Thank you for taking the time to contribute. MimixBox welcomes new applets, opti
 
 ## Development Environment
 
-- Go 1.26.6 or later (see `go.mod`)
+- Go 1.26.9 or later (see `go.mod`)
 - `make`
 - `git`
 - [`atago`](https://github.com/nao1215/atago) for the end-to-end tests (`make tools`)

Dockerfile

@@ -1,7 +1,7 @@
 # Pin the base image to a specific tag and digest so builds are reproducible and not
 # affected by a silently moving `golang:latest`. Matches the toolchain declared
 # in go.mod (go 1.26.x).
-FROM golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d AS builder
+FROM golang:1.27-bookworm@sha256:69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195 AS builder
 ENV ROOT=/go/app
 ENV IT_SHELL=/home/mimixbox/do_integration_test.sh
 # Pin atago to a tagged release for reproducible integration tests.

README.md

@@ -497,7 +497,7 @@ $ sudo mimixbox --install /usr/local/bin
 
 ### Use "go install"
 
-Building from source needs Go 1.26.6 or later.
+Building from source needs Go 1.26.9 or later.
 
 ```shell
 $ go install github.com/nao1215/mimixbox/cmd/mimixbox@latest

go.mod

@@ -1,12 +1,12 @@
 module github.com/nao1215/mimixbox
 
-go 1.26.6
+go 1.26.9
 
 require (
 	github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5
 	github.com/dsnet/compress v0.0.1
 	github.com/fogleman/gg v1.3.0
-	github.com/klauspost/compress v1.20.0
+	github.com/klauspost/compress v1.20.1
 	github.com/nsf/termbox-go v1.1.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.12.1
@@ -15,7 +15,7 @@ require (
 	golang.org/x/crypto v0.57.0
 	golang.org/x/sys v0.48.0
 	golang.org/x/term v0.46.0
-	modernc.org/sqlite v1.59.0
+	modernc.org/sqlite v1.60.1
 )
 
 require (
@@ -24,12 +24,12 @@ require (
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/mattn/go-runewidth v0.0.30 // indirect
-	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/mattn/go-runewidth v0.0.31 // indirect
+	github.com/ncruces/go-strftime v1.1.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/image v0.46.0 // indirect
-	modernc.org/libc v1.77.0 // indirect
+	modernc.org/libc v1.77.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
 )