From 09c95d5e89d5ab1f14b6cb5a6d7d2b50a86f3133 Mon Sep 17 00:00:00 2001 From: Jahvon Dockery Date: Tue, 13 Oct 2026 00:50:22 -0400 Subject: [PATCH] fix(ci): bump go toolchain and dedupe govuln sarif stacks The security job fails on upload since codeql-action 4.38.2, which rejects SARIF results with duplicate stacks. govulncheck emits exact duplicate call stacks for some findings, and on go1.26.8 it reports several reachable stdlib net/http vulns that do so. Bump the toolchain to go1.26.9, which fixes those vulns, and dedupe stacks before writing govuln.sarif so a future finding cannot break the upload again. --- .execs/validate.flow | 5 ++++- go.mod | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.execs/validate.flow b/.execs/validate.flow index c9c88b49..b78d136d 100644 --- a/.execs/validate.flow +++ b/.execs/validate.flow @@ -95,7 +95,10 @@ executables: fi if [ "${CI:-}" = "true" ]; then - govulncheck -format sarif ./... > govuln.sarif + # govulncheck can list the same call stack twice for a finding, and upload-sarif rejects + # duplicate stacks. + govulncheck -format sarif ./... \ + | jq '.runs[].results[] |= (if .stacks then .stacks |= unique else . end)' > govuln.sarif echo "Security scan completed. Results saved to govuln.sarif" else govulncheck ./... diff --git a/go.mod b/go.mod index b3cb8e82..b3f502db 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/flowexec/flow/v2 go 1.26.0 -toolchain go1.26.8 +toolchain go1.26.9 require ( charm.land/bubbletea/v2 v2.0.10