From ba4612f5e8c1b79f5c5f64d13ebb6453e49b72d3 Mon Sep 17 00:00:00 2001
From: Ashir Amin <ashir.amin@cortex.io>
Date: Sun, 7 Jun 2026 20:30:51 -0500
Subject: [PATCH] =?UTF-8?q?fix(deps):=20bump=20Go=20toolchain=201.26.3=20?=
 =?UTF-8?q?=E2=86=92=201.26.4=20for=20CVE-2026-42504?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves HIGH CVE-2026-42504 in the Go stdlib (installed v1.26.3,
fixed in 1.26.4). Bumps GOLANG_VERSION in both Dockerfile stages and
the `go` directive in the agent, scaffold, and SDK modules.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 agent/go.mod       | 2 +-
 docker/Dockerfile  | 4 ++--
 scaffold/go/go.mod | 2 +-
 sdks/go/go.mod     | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/agent/go.mod b/agent/go.mod
index 34e3a84..6ddc3f9 100644
--- a/agent/go.mod
+++ b/agent/go.mod
@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon
 
-go 1.26.3
+go 1.26.4
 
 require (
 	github.com/google/uuid v1.6.0
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 5f15029..b2d349c 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -3,7 +3,7 @@ FROM debian:stable-slim AS builder
 
 RUN apt-get update && apt-get upgrade -y && apt-get install -y protobuf-compiler git wget build-essential
 
-ENV GOLANG_VERSION=1.26.3
+ENV GOLANG_VERSION=1.26.4
 RUN wget -q "https://dl.google.com/go/go${GOLANG_VERSION}.linux-$(dpkg --print-architecture).tar.gz" -O /tmp/go.tar.gz \
     && tar -C /usr/local -xzf /tmp/go.tar.gz \
     && rm /tmp/go.tar.gz
@@ -52,7 +52,7 @@ RUN git clone https://github.com/cortexapps/snyk-broker.git /tmp/snyk-broker &&
 ENV PATH="/usr/local/lib/node_modules/.bin:${PATH}"
 
 # Install Go (needed by scaffold apps that build on top of this image)
-ENV GOLANG_VERSION=1.26.3
+ENV GOLANG_VERSION=1.26.4
 RUN wget -q "https://dl.google.com/go/go${GOLANG_VERSION}.linux-$(dpkg --print-architecture).tar.gz" -O /tmp/go.tar.gz \
     && tar -C /usr/local -xzf /tmp/go.tar.gz \
     && rm /tmp/go.tar.gz
diff --git a/scaffold/go/go.mod b/scaffold/go/go.mod
index bf0b0fe..3f74d64 100644
--- a/scaffold/go/go.mod
+++ b/scaffold/go/go.mod
@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon_apps/{{.ProjectName}}
 
-go 1.26.3
+go 1.26.4
 
 require (
 	github.com/google/uuid v1.6.0
diff --git a/sdks/go/go.mod b/sdks/go/go.mod
index e1cf5e5..27a66b7 100644
--- a/sdks/go/go.mod
+++ b/sdks/go/go.mod
@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon-go
 
-go 1.26.3
+go 1.26.4
 
 require (
 	github.com/google/uuid v1.6.0