Bump Go and x/net for GO-2026-4918#378
Conversation
Rename module to good-native org
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughBumps Go toolchain to 1.26.3 and golang.org/x/net to v0.53.0, updates transitive golang.org/x modules, updates CI setup-go versions and Docker builder images, extracts Fly pool reconciliation into dedicated jobs and reduces review-app pool targets, and adds an Unreleased changelog entry. ChangesDependency & Toolchain Security Update
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
|
Updates to Preview Branch (work/interesting-merkle-004c74) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 37-38: The changelog check is failing because this PR doesn't
introduce any new "## [Unreleased]" content unique from main; add a new net‑new
Unreleased entry so MAIN_UNRELEASED != HEAD_UNRELEASED. Edit CHANGELOG.md to add
a top-level "## [Unreleased]" section (or add an additional unique bullet under
the existing Unreleased section) — for example add a short one-line bullet
referencing this bump (e.g., "Bump Go to 1.26.3 and golang.org/x/net to v0.53.0
— fixes GO-2026-4918") or any other distinct note that only exists in this PR so
the pipeline detects a change. Ensure the header text is exactly "##
[Unreleased]" and the new bullet is not identical to the entry already present
on main.
In `@go.mod`:
- Line 3: CI workflows are pinned to go-version: "1.26.2" but go.mod now
specifies go 1.26.3, causing CI failures; update all occurrences of the
go-version key in .github/workflows (the jobs that currently set go-version:
"1.26.2") to "1.26.3" or replace them with go-version-file: go.mod so the runner
reads the module file; search for the literal go-version: "1.26.2" in the
workflow files and update each to either go-version: "1.26.3" or
go-version-file: go.mod to match the go.mod entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 7a19c9a8-04bc-430d-b290-503200580091
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
CHANGELOG.mdgo.mod
| module github.com/good-native/hover | ||
|
|
||
| go 1.26.2 | ||
| go 1.26.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify Go toolchain/version config in workflows and repo files.
set -euo pipefail
echo "== Workflow files mentioning Go version/toolchain =="
fd -i '.*\.(yml|yaml)$' .github/workflows -x rg -n --no-heading 'setup-go|go-version|GOTOOLCHAIN|1\.26\.2|1\.26\.3|toolchain'
echo
echo "== Repo files mentioning Go version/toolchain =="
rg -n --no-heading 'go 1\.26\.[0-9]+|toolchain go1\.26\.[0-9]+|GOTOOLCHAIN'Repository: Good-Native/hover
Length of output: 549
Multiple CI workflows are hardcoded to Go 1.26.2 but go.mod now requires Go 1.26.3.
The workflows in .github/workflows have hardcoded go-version: "1.26.2" in multiple jobs (lines 43, 83, 128, 171, 173, 255). This blocks execution since go.mod now declares go 1.26.3. Update these to 1.26.3, or switch to go-version-file: go.mod (like the workflow at line 20-22) to auto-resolve the version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, CI workflows are pinned to go-version: "1.26.2" but go.mod
now specifies go 1.26.3, causing CI failures; update all occurrences of the
go-version key in .github/workflows (the jobs that currently set go-version:
"1.26.2") to "1.26.3" or replace them with go-version-file: go.mod so the runner
reads the module file; search for the literal go-version: "1.26.2" in the
workflow files and update each to either go-version: "1.26.3" or
go-version-file: go.mod to match the go.mod entry.
Release VersionsApp patch: ChangelogChanged
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
🐝 Review App Deployed Homepage: https://hover-pr-378.fly.dev |
|
🐝 Review App Deployed Homepage: https://hover-pr-378.fly.dev |
|
🐝 Review App Deployed Homepage: https://hover-pr-378.fly.dev |
Bump Go and x/net for GO-2026-4918
1 participant
Summary
golang.org/x/netto v0.53.0 to clear GO-2026-4918 (HTTP/2SETTINGS_MAX_FRAME_SIZEinfinite-loop) flagged by govulncheck.Test plan
schema_migrations_pkeyduplicate-key errorNeed help on this PR? Tag
@codesmithwith what you need.Summary by CodeRabbit
Bug Fixes
Chores