From 7d8b91268dab69d7150f345c448b5e250163146a Mon Sep 17 00:00:00 2001
From: Seefs <40468931+seefs001@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:24:05 +0800
Subject: [PATCH] fix: upgrade Go to 1.26.10 for CVE-2026-111943 (#7942)

---
 .github/workflows/electron-build.yml | 2 +-
 .github/workflows/release.yml        | 6 +++---
 Dockerfile                           | 2 +-
 Dockerfile.dev                       | 2 +-
 go.mod                               | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/electron-build.yml b/.github/workflows/electron-build.yml
index fa0587ae60..f5f42f48c2 100644
--- a/.github/workflows/electron-build.yml
+++ b/.github/workflows/electron-build.yml
@@ -39,7 +39,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '>=1.26'
+          go-version-file: go.mod
 
       - name: Build frontend
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c942010aba..7e447ad7f8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '>=1.26'
+          go-version-file: go.mod
       - name: Build Backend (amd64)
         run: |
           go mod download
@@ -98,7 +98,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '>=1.26'
+          go-version-file: go.mod
       - name: Build Backend
         run: |
           go mod download
@@ -149,7 +149,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '>=1.26'
+          go-version-file: go.mod
       - name: Build Backend
         run: |
           go mod download
diff --git a/Dockerfile b/Dockerfile
index ddcee582c2..1373c28e4c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,7 @@ COPY ./web ./
 COPY ./VERSION /build/VERSION
 RUN DISABLE_ESLINT_PLUGIN='true' VITE_REACT_APP_VERSION=$(cat /build/VERSION) bun run build
 
-FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder2
+FROM golang:1.26.10-alpine@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder2
 ENV GO111MODULE=on CGO_ENABLED=0 GOWORK=off
 
 ARG TARGETOS
diff --git a/Dockerfile.dev b/Dockerfile.dev
index e58bf79bc4..561e9829eb 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,7 +1,7 @@
 # Backend-only build for frontend development
 # Skips frontend build and uses a placeholder for //go:embed web/dist
 
-FROM golang:1.26.1-alpine AS builder
+FROM golang:1.26.10-alpine AS builder
 
 ENV GO111MODULE=on CGO_ENABLED=0
 ARG TARGETOS
diff --git a/go.mod b/go.mod
index 913500d366..e88e8dae8b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,7 @@
 module github.com/QuantumNous/new-api
 
-// +heroku goVersion go1.18
-go 1.26
+// +heroku goVersion go1.26.10
+go 1.26.10
 
 require (
 	github.com/Calcium-Ion/go-epay v0.0.5