Paweł Gronowski b665fde220 Update Go to 1.26.6 ...

This release includes 10 security fixes covering module checksum
verification, denial-of-service protections, parser crashes, XSS, and
IDNA hostname validation, most notably:

- CVE-2026-56865: prevent malicious GOPROXY servers from bypassing sumdb transparency-log verification: https://go.dev/issue/80744
- CVE-2026-56864: prevent malicious GOSUMDB servers from serving unauthenticated module content: https://go.dev/issue/80745
- CVE-2026-56859: add recursion limits for XML decoding: https://go.dev/issue/80481
- CVE-2026-56853: apply ReadHeaderTimeout during unencrypted HTTP/2 detection: https://go.dev/issue/80205
- CVE-2026-56860: prevent quadratic behavior in URL path resolution: https://go.dev/issue/80494
- CVE-2026-46600: prevent panics when parsing malformed SVCB/HTTPS DNS records: https://go.dev/issue/79795
- CVE-2026-56862: limit excessive TLS post-handshake messages: https://go.dev/issue/80528
- CVE-2026-56858: fix JavaScript regexp context tracking in html/template: https://go.dev/issue/80435
- CVE-2026-39821: reject invalid ASCII-only Punycode labels: https://go.dev/issue/78760
- CVE-2026-33818: add recursion limits for ASN.1 unmarshalling: https://go.dev/issue/80405

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

2026-08-13 22:13:25 +02:00

..

action.yml

Update Go to 1.26.6

2026-08-13 22:13:25 +02:00