From 4c13943a35af4a3f3d53ec9b1747623d49d5c503 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 19:53:49 +0000 Subject: [PATCH 1/2] chore(deps): bump golang.org/x/oauth2 from 0.36.0 to 0.37.0 Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.36.0 to 0.37.0. - [Commits](https://github.com/golang/oauth2/compare/v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 4 ++-- go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index 2b53dde..eea5d09 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,8 @@ module github.com/jferrl/go-githubauth -go 1.25.0 +go 1.26.0 require ( github.com/golang-jwt/jwt/v5 v5.3.1 - golang.org/x/oauth2 v0.36.0 + golang.org/x/oauth2 v0.37.0 ) diff --git a/go.sum b/go.sum index 3e7b657..5487d42 100644 --- a/go.sum +++ b/go.sum @@ -1,4 +1,4 @@ github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= From 82e5d799ffbd5d5ddda57066682d5fcd773bac99 Mon Sep 17 00:00:00 2001 From: jferrl Date: Thu, 17 Sep 2026 19:05:29 +0200 Subject: [PATCH 2/2] ci: move to Go 1.26 toolchain for the oauth2 0.37.0 bump golang.org/x/oauth2 v0.37.0 raised its go directive to 1.26.0, which forces this module's go directive to 1.26.0 as well. Two CI jobs were still pinned below that and failed: - tests ran a 1.25.x matrix with GOTOOLCHAIN=local, so the toolchain refused the module ("go.mod requires go >= 1.26.0"). - golangci-lint v2.4.0 is built with go1.25 and refuses to load a config targeting a newer Go than its own build. Move the test matrix to the two Go versions upstream still supports (1.26.x, 1.27.x) and bump golangci-lint to v2.13.2, which is built with go1.26. Coverage upload follows the newest version in the matrix. README now states the new minimum. go-github, which most users pair this with, already requires 1.26.0, and Go 1.25 is end of life. --- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/test.yml | 4 ++-- README.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 6d6c854..21988f1 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -17,6 +17,6 @@ jobs: - name: golangci-lint uses: golangci/golangci-lint-action@v9 with: - version: v2.4.0 + version: v2.13.2 only-new-issues: true args: --verbose \ No newline at end of file diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a5b2755..4938bd1 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,11 +21,11 @@ jobs: contents: read # for actions/checkout to fetch code strategy: matrix: - go-version: [1.25.x] + go-version: [1.26.x, 1.27.x] platform: [ubuntu-latest] include: # only update test coverage stats with the most recent go version on linux - - go-version: 1.25.x + - go-version: 1.27.x platform: ubuntu-latest update-coverage: true runs-on: ${{ matrix.platform }} diff --git a/README.md b/README.md index 2a20afa..356dc5a 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ GitHub authentication for Go, exposed as standard [`oauth2.TokenSource`](https:/ go get github.com/jferrl/go-githubauth ``` -Requires Go 1.25+. +Requires Go 1.26+. ## Quick start