Repository navigation
Require Go 1.26.11: GO-2026-6859 blocks MegaLinter on every pull request #6043
Description
🤖 Generated by the Agentic Engineer
Problem
The osv-scanner step in MegaLinter now reports GO-2026-6859 against the Go standard library for modules that declare go 1.26.10. The fix is in 1.26.11. osv-scanner is a blocking linter, and CI - Required Checks requires MegaLinter on pull requests, so every new or re-run pull request is blocked. The merge-group run has no lint job, so PRs already in the queue aren't affected.
Evidence
- On chore(deps): update devantler-tech/agent-plugins digest to 7bcf710 #6032 (an unrelated digest bump), MegaLinter failed only on osv-scanner, which listed
stdlib 1.26.10 → fixed 1.26.11for the rootgo.modand two test modules (job 130295993320). - The same advisory breaks the World at Ruin native builds on Go 1.27.3 (Build with Go 1.27.4: GO-2026-6859 fails every Nakama native build world-at-ruin#1681).
Acceptance criteria
- Every module directive pinned to
go 1.26.10requiresgo 1.26.11. Modules stay tidy, and the root module builds and vets. - MegaLinter's osv-scanner passes on the pull request head.
Size
XS
Activity
devantler commentedon Nov 11, 2026
The new #6042 head also reproduces GO-2026-6859 in the required organization scan (job) and the native gateway fixture scan (job). Both scanners completed and explicitly returned the advisory as blocking.
The official Go database entry identifies the fixed releases as 1.26.11 and 1.27.4. #6041 now has a native dependency on this issue. I will integrate the reviewed main fix from #6045 before rerunning the Email cleanup delivery checks; the scans and cleanup gate remain enforced.
chore: agent-claim #6043 nonce=dcd5161cdc819badf833a912d4fa4d32
chore: agent-claim #6043 nonce=37b09197aaeb28377bf0fa934cb18d71
chore: agent-claim #6043 nonce=8624753e1153c2f6b0f2e89cf7da7e16
devantler commentedon Nov 11, 2026
Post-merge verification passed on current
mainrevision1913f974e5aa5a0e2f72c8bf146e2d7e1104973d: Scan Go Vulnerabilities, run 43106533153, attempt 1, completed successfully at 21:53:36 UTC on 11 November.All five jobs completed successfully. The module inventory and its regression checks passed; the root module and both scanned test modules passed their native scan judges. The root scan used Go 1.26.11, analysed 71 packages with Go code and reached no unaccepted advisory. The deliberately vulnerable negative control analysed one package, reported 42 reachable advisories and passed its expected-blocking judge, confirming the scanner was detecting findings.
The earlier scheduled failure at
8db83359remains historical evidence. This records the manual scan of the repaired revision; production image rebuilds and their deployment acceptance remain separate.