From 19855342fee78484172a6ccb9a417a964465a007 Mon Sep 17 00:00:00 2001 From: Stephan Renatus Date: Thu, 9 Jul 2026 11:07:33 +0200 Subject: [PATCH] build(go): bump to 1.26.5 https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc govulncheck flagged us for: * crypto/tls: Encrypted Client Hello privacy leak The Encrypted Client Hello implementation would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. Thanks to Coia Prant (github.com/rbqvq) for reporting this issue. This is CVE-2026-42505 and Go issue https://go.dev/issue/79282. Signed-off-by: Stephan Renatus --- .go-version | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.go-version b/.go-version index ea0928cedf..8fe00a57fe 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.26.4 +1.26.5