Nick Craig-Wood 645e1ea5be build: fix multiple CVEs by upgrading to go1.26.6 ...

- CVE-2026-56860: net/url: quadratic complexity in resolvePath
- CVE-2026-56858: html/template: JavaScript regexp context tracking
- CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
- CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
- CVE-2026-56859: encoding/xml: recursion depth guard during decode
- CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
- CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
- CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna

This also updates the go1.25 test job to go1.25.13 which contains the
same fixes.

(cherry picked from commit f0b210a886)

2026-09-04 14:07:18 +01:00

..

ISSUE_TEMPLATE

github: modernise issue and pull request templates

2026-06-18 13:22:19 +01:00

workflows

build: fix multiple CVEs by upgrading to go1.26.6

2026-09-04 14:07:18 +01:00

CODEOWNERS

github: add CODEOWNERS for per-area review routing

2026-06-22 15:18:26 +01:00

dependabot.yml

build: add 7 day cool down period for dependabot security fixes

2026-07-28 18:03:58 +01:00

PULL_REQUEST_TEMPLATE.md

docs: add guidance for AI-assisted contributions

2026-07-13 17:48:10 +01:00