sirtimbly/cairnquire
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgrade Go toolchain to 1.26.5

Browse Source
This commit is contained in:
Tim Bendt
2026-07-22 13:07:00 -04:00
parent 4454e918c2
commit ae0939177c
7 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.project/STATUS.md
View File

@@ -2,13 +2,13 @@
**Updated:** 2026-07-22
**Branch:** main
**Last Commit:** 09f51d1 - Add queued email notifications for collaboration events
**Baseline Commit:** 4454e91 - Add Cloudflare email and collaboration workflows
## Quick Stats
| Metric | Value |
|--------|-------|
| Total Tracked Files | 201 |
| Total Tracked Files | 208 |
| Go Files | 63 |
| Swift Files | 15 (macOS app and package manifest) |
| Go Test Files | 18 |
@@ -19,8 +19,10 @@
- `go test -coverpkg=./... -coverprofile=... ./...` passes with 52.4% aggregate statement coverage.
- `swift build` passes for the macOS app and CLI.
- Focused race tests pass for email, collaboration, and HTTP packages. A full `go test -race ./...` exceeds the current five-minute local timeout.
- `govulncheck` currently fails because Go 1.24.2 has 31 reachable standard-library vulnerabilities; the pinned Go toolchain must be upgraded before production sign-off.
- `go test -race ./...` passes under Go 1.26.5.
- Go is pinned consistently to 1.26.5 for local, CI, module, workspace, and container builds.
- `govulncheck@latest` reports no reachable vulnerabilities.
- The `golang:1.26.5-bookworm` production image builds successfully.
- Highest package coverage: Markdown 87.0%, email 77.9%, store 70.0%, config 67.9%, auth 54.9%, and sync 54.2%.
- Collaboration, configuration, email-provider, and collaboration HTTP integration tests are present; database, logging, and realtime still lack direct suites.
@@ -61,7 +63,6 @@ Milestone 4 collaboration completion:
## Known Gaps Requiring Human Review
- Go 1.24.2 is below the patched versions reported by `govulncheck`, including fixes for `html/template`, `crypto/tls`, `net/http`, and `crypto/x509` vulnerabilities.
- WebSocket broadcasts are authenticated but not filtered by per-document permissions.
- Content-hash downloads are not tied back to effective document permission.
- Browser caches are not cleared on logout.

2
.project/adrs/adr-001-tech-stack.md
View File

@@ -9,7 +9,7 @@ dependencies, secure server-side rendering, and a straightforward deployment
artifact.
## Decision
Use Go 1.24+ with the standard library plus minimal, audited packages. The Go
Use Go 1.26+ with the standard library plus minimal, audited packages. The Go
binary serves HTML templates and embeds its CSS, images, and small browser
scripts. There is no separate SPA, Node dependency tree, or frontend build
pipeline.

2
.project/project-plan.md
View File

@@ -253,7 +253,7 @@ See [architecture-overview.md](architecture-overview.md) for detailed component
## Technology Stack
### Backend (Go 1.24+)
### Backend (Go 1.26+)
| Component | Library | Justification |
| ------------- | ------------------------------------------- | ---------------------------------------- |