From 2035dad2a2d74cdaee872a712d506ee41d83db69 Mon Sep 17 00:00:00 2001 From: Samantha Jayasinghe Date: Fri, 14 Aug 2026 10:04:19 +1200 Subject: [PATCH] ROSAENG-63302: Add toolchain go1.26.5 to remediate Go stdlib CVEs Fixes CVE-2026-39822 (CVSS 7.5) and CVE-2026-42505 (CVSS 5.3) by pinning the Go toolchain to 1.26.5. Co-Authored-By: Claude Opus 4.6 --- go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/go.mod b/go.mod index a622470a..35fec1fe 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/openshift/managed-cluster-validating-webhooks go 1.26.0 +toolchain go1.26.5 + require ( github.com/evanphx/json-patch v5.9.11+incompatible github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344