v0.2.7

v0.2.7

Source Code Updates

• Bumped the Go toolchain from 1.26.5 to 1.26.6, closing several CVEs relevant to websyncd:
  • CVE-2026-33818 (encoding/asn1, CVSS 7.5): a stack-exhaustion denial-of-service when
    unmarshaling deeply nested, recursive structures. Relevant because crypto/tls parses X.509
    certificates via encoding/asn1 during TLS/QUIC handshakes.
  • CVE-2026-56860 (net/url): quadratic-time complexity when resolving paths containing
    crafted .. segments, allowing a denial-of-service via pathological input. net/url is used
    directly by websyncd.
  • CVE-2026-56864 and CVE-2026-56865 (Go toolchain / module sumdb verification, CVSS 7.5
    and 8.4): a malicious GOPROXY or GOSUMDB could previously smuggle unverified module
    content into the local module cache during go build/go mod download. Fixed by building
    with the updated toolchain.
  • Two further CVEs fixed in 1.26.6 (encoding/xml, html/template) do not affect websyncd, as
    neither package is used by this codebase.
• Updated github.com/quic-go/quic-go from v0.60.0 to v0.61.0. No CVE, but http3 no longer
  includes invalid header values in validation errors, avoiding accidental exposure of sensitive
  values when errors are logged.
• Updated indirect dependencies golang.org/x/crypto (v0.54.0 → v0.55.0), golang.org/x/net
  (v0.57.0 → v0.58.0), and golang.org/x/text (v0.40.0 → v0.41.0) to stay current with the
  toolchain and quic-go's requirements. No additional CVE fixes were identified specific to
  this version range.
• govulncheck reports no vulnerabilities reachable from websyncd's code after the update. One
  advisory (GO-2026-5932, unmaintained/unsafe golang.org/x/crypto/openpgp package) remains in
  the dependency tree but is not imported by websyncd and has no available fix.

CI Updates

• Upgraded the actions/setup-go GitHub Action from v6 to v7 in the CI workflow.

Full Changelog: v0.2.6...v0.2.7