Repository navigation
chore: update Go and macOS CI toolchains - #166
Merged
Merged
Conversation
Release binaries are built from the go.mod version (setup-go uses go-version-file), so they were compiled with go1.25.12. govulncheck reports five stdlib vulnerabilities reachable from our code on that toolchain (crypto/tls, net/http, net/url via the self-updater and httputil.Do; encoding/xml via snapshot dock plist parsing; encoding/asn1). Go 1.25 is also out of support since the 1.27 release. On go1.26.8 govulncheck reports 0 reachable vulnerabilities; vet, L1 (make test-unit) and golangci-lint v2.11.4 are clean.
This was referenced Sep 23, 2026
fullstackjam
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Bumps the Go directive from 1.25.12 to 1.26.8, which also selects the CI and release toolchain. Moves the PR and release L4 VM jobs from macos-14 to macos-15 (Apple Silicon), and updates the corresponding runner documentation.
Why?
Testing
Cross-repo checklist
Notes for reviewer
The VM change updates the CI host, not OpenBoot's runtime macOS requirement. No checks are removed or bypassed. Subsequent dependency PRs remain #168 and #169; the independent Actions update is #167.
Rollback: revert this PR. Returning L4 to macos-14 also restores the known Homebrew source-build slowdown.