[release-3.7] Bump Go to 1.26.6
Project: etcd-io/etcd | Language: Go | Concepts: dependency-management, build-systems | Difficulty: junior
Link: https://github.com/etcd-io/etcd/pull/22287
The problem
The project's CI job for govulncheck was failing because the Go toolchain version in use (1.26.5) was outdated. This prevented vulnerability checks and other tooling from working as expected, requiring an update to the latest patch release (1.26.6).
Why it's non-trivial
A naive fix might only update the Go version in one place, but etcd is a multi-module repository. Each submodule and toolchain file specifies its own Go toolchain version, so every relevant file must be updated to avoid version mismatches and ensure all builds and tools use the correct Go version.
The approach
The PR updates the Go toolchain version from 1.26.5 to 1.26.6 in every relevant file across the repository. Here are the main changes:
Update the global Go version:
diff --git a/.go-version b/.go-version
index 8fe00a57fe1..f250c8f6045 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.26.5
+1.26.6
This updates the root .go-version file, which is used by tools like asdf or gvm to determine the Go version for the project.
Update the toolchain version in each module's go.mod:
-toolchain go1.26.5
+toolchain go1.26.6
This line appears in all the project's go.mod files (for example, api/go.mod, cache/go.mod, client/pkg/go.mod, etc.). Updating the toolchain directive ensures that Go 1.26.6 is used for building and tooling in each submodule.
Update the workspace file:
diff --git a/go.work b/go.work
index a45b75f624a..29c3e9a409a 100644
--- a/go.work
+++ b/go.work
@@ -2,7 +2,7 @@
go 1.26
-toolchain go1.26.5
+toolchain go1.26.6
This ensures that the Go workspace uses the correct toolchain version as well.
From the review thread
No notable review discussion on this PR.
Takeaways
- When updating a toolchain version in a multi-module repository, update every file that specifies the version to avoid inconsistencies.
- Keeping the build toolchain up-to-date is essential for security tooling (like
govulncheck) and for ensuring compatibility with CI systems. - Even minor version bumps should be applied uniformly across all modules and workspace files to prevent subtle build or tooling issues.