chore(BRIDGE-587): patch vulnerabilities July 2026

Author: annatar

.github/actions/govulncheck.sh

@@ -9,8 +9,7 @@ main(){
     jq -r '.finding | select( (.osv != null) and (.trace[0].function != null) ) | .osv ' < vulns.json > vulns_osv_ids.txt
 
     ignore GO-2026-4550 "Indirect import from goopengpg. Waiting for fix on their side"
-    ignore GO-2026-5856 "BRIDGE-587 Handshakes which used Encrypted Client Hello could be de-anonymized by passive network observer."
-    
+
     has_vulns
 
     echo

.github/workflows/check.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Run govulncheck
         uses: ./.github/actions/govulncheck
         with:
-          go-version-input: 1.26.4
+          go-version-input: 1.26.5
           go-package: ./...
 
       - name: Run golangci-lint

go.mod

@@ -2,7 +2,7 @@ module github.com/ProtonMail/go-proton-api
 
 go 1.26.1
 
-toolchain go1.26.4
+toolchain go1.26.5
 
 require (
 	github.com/Masterminds/semver/v3 v3.4.0