From f96045738b9948b3bf2ccdeecf51517f18fed1b6 Mon Sep 17 00:00:00 2001
From: Andrey Marchenko <andrey.marchenko@datadoghq.com>
Date: Fri, 17 Apr 2026 12:01:21 +0200
Subject: [PATCH] Bump Go toolchain to 1.26.2.

Pin the local toolchain, CI workflows, and documentation to Go 1.26.2 so releases and validation run on the patched version required for the recent CVE response.

Made-with: Cursor
---
 .github/workflows/ci.yml         | 8 ++++----
 .github/workflows/prerelease.yml | 2 +-
 .github/workflows/release.yml    | 2 +-
 AGENTS.md                        | 2 +-
 README.md                        | 4 ++--
 go.mod                           | 2 ++
 6 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0467da8..6eb2a68 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
         with:
-          go-version: "1.26.x"
+          go-version: "1.26.2"
 
       - name: Cache Go modules
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7
@@ -26,9 +26,9 @@ jobs:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-1.26-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-1.26.2-${{ hashFiles('**/go.sum') }}
           restore-keys: |
-            ${{ runner.os }}-go-1.26-
+            ${{ runner.os }}-go-1.26.2-
 
       - name: Download dependencies
         run: go mod download
@@ -58,7 +58,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
         with:
-          go-version: "1.26.x"
+          go-version: "1.26.2"
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v6
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 4b696c8..e263150 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
         with:
-          go-version: '1.26'
+          go-version: '1.26.2'
 
       - name: Build binaries
         run: make release
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 77808b1..f37f661 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
         with:
-          go-version: '1.26'
+          go-version: '1.26.2'
 
       - name: Build binaries
         run: make release
diff --git a/AGENTS.md b/AGENTS.md
index 2c7140b..6960440 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -47,7 +47,7 @@ go test -v ./...           # Verbose testing
 ## Development
 
 - Uses `dd-trace-go/v2` for Datadog tracing and CI Visibility
-- Use go 1.26
+- Use go 1.26.2
 - Use `strings` and `slices` packages, don't write your own string manipulation functions
 - Always run `make test` after any change. Any new functionality must be covered by test.
 - Always run `make lint` after any change. Address any linting issues found.
diff --git a/README.md b/README.md
index 9ac46dc..353bd2a 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ git clone https://github.com/DataDog/ddtest.git
 cd ddtest && make build
 ```
 
-This will create the `ddtest` binary in the current directory. It requires Go 1.26+.
+This will create the `ddtest` binary in the current directory. It requires Go 1.26.2+.
 
 ## Prerequisites
 
@@ -521,7 +521,7 @@ The `--runtime-tags` option lets you override your local runtime tags to match y
 
 ### Prerequisites
 
-- Go 1.26.0 or later
+- Go 1.26.2 or later
 
 ### Building
 
diff --git a/go.mod b/go.mod
index 0c164ef..96e98cf 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/DataDog/ddtest
 
 go 1.26
 
+toolchain go1.26.2
+
 require (
 	github.com/DataDog/dd-trace-go/v2 v2.7.1
 	github.com/bmatcuk/doublestar/v4 v4.10.0