Upgrade to Go 1.26.1

.circleci/config.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     parallelism: 8
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26
     steps:
       - checkout
 
@@ -37,7 +37,7 @@ jobs:
 
   report:
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26
     steps:
       - checkout
       - attach_workspace:

.github/dependabot.yml

@@ -28,4 +28,4 @@ updates:
     schedule:
       interval: "weekly"
     # Allow up to 0 open pull requests for pip dependencies
-    open-pull-requests-limit: 0
+    open-pull-requests-limit: 0

Dockerfile

@@ -1,5 +1,5 @@
 # golang alpine
-FROM golang:1.26.0-alpine AS builder
+FROM golang:1.26.1-alpine AS builder
 
 ARG TARGETARCH
 ARG TARGETOS
@@ -17,7 +17,7 @@
 COPY go.sum .
 RUN go mod download && go mod verify
 
 COPY . .
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine

docs/pages/release_notes.rst

@@ -2,6 +2,36 @@
 Release notes
 #############
 
+****************
+Peanut (v6.1.13)
+****************
+
+Release date: 2026-03-15
+
+- Upgrade to Go 1.26.1 to fix GO-2026-4601, GO-2026-4602 and GO-2026-4603
+
+**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v6.1.12...v6.1.13
+
+****************
+Peanut (v6.1.12)
+****************
+
+Release date: 2026-03-03
+
+- Update Nats server version to fix https://pkg.go.dev/vuln/GO-2026-4533
+
+**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v6.1.11...v6.1.12
+
+****************
+Peanut (v6.1.11)
+****************
+
+Release date: 2026-02-12
+
+- Update Docker alpine base image to 3.23.3
+
+**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v6.1.10...v6.1.11
+
 ****************
 Peanut (v6.1.10)
 ****************
@@ -343,6 +373,14 @@ The following features have been deprecated:
 - Network v1 API, to be removed
 - VDR v1 API, replaced by VDR v2
 
+*************************
+Hazelnut update (v5.4.25)
+*************************
+
+Release date: 2026-03-15
+
+- Upgrade to Go 1.26.1 to fix GO-2026-4601, GO-2026-4602 and GO-2026-4603
+
 *************************
 Hazelnut update (v5.4.24)
 *************************

go.mod

@@ -2,7 +2,7 @@ module github.com/nuts-foundation/nuts-node
 
 // This is the minimal version, the actual go version is determined by the images in the Dockerfile
 // This version is used in automated tests such as the 'Scheduled govulncheck' action
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0

http/requestlogger_test.go

@@ -21,6 +21,10 @@ package http
 import (
 	"bytes"
 	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
 	"github.com/labstack/echo/v4"
 	"github.com/nuts-foundation/nuts-node/core"
 	"github.com/nuts-foundation/nuts-node/mock"
@@ -29,9 +33,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
-	"net/http"
-	"net/http/httptest"
-	"testing"
 )
 
 func Test_requestLoggerMiddleware(t *testing.T) {
@@ -122,33 +123,26 @@ func Test_requestLoggerMiddleware(t *testing.T) {
 func Test_bodyLoggerMiddleware(t *testing.T) {
 	t.Run("it logs", func(t *testing.T) {
 		ctrl := gomock.NewController(t)
-
-		e := echo.New()
-		request := httptest.NewRequest("GET", "/", bytes.NewReader([]byte(`"request"`)))
-		request.Header.Set("Content-Type", "application/json")
-		responseRecorder := httptest.NewRecorder()
-		response := echo.NewResponse(responseRecorder, e)
-		response.Header().Set("Content-Type", "application/json")
+		response := &echo.Response{}
 		echoMock := mock.NewMockContext(ctrl)
-		echoMock.EXPECT().NoContent(http.StatusNoContent).Do(func(status int) {
-			response.Status = status
-			response.Write([]byte(`"response"`))
-		})
-		echoMock.EXPECT().Request().MinTimes(1).Return(request)
-		echoMock.EXPECT().Response().MinTimes(1).Return(response)
+		echoMock.EXPECT().NoContent(http.StatusNoContent).Do(func(status int) { response.Status = status })
+		echoMock.EXPECT().Request().Return(&http.Request{RequestURI: "/test"})
+		echoMock.EXPECT().Response().Return(response)
+		echoMock.EXPECT().RealIP().Return("::1")
 
 		logger, hook := test.NewNullLogger()
-		logFunc := bodyLoggerMiddleware(func(c echo.Context) bool {
+		logFunc := requestLoggerMiddleware(func(c echo.Context) bool {
 			return false
 		}, logger.WithFields(logrus.Fields{}))
 		err := logFunc(func(context echo.Context) error {
 			return context.NoContent(http.StatusNoContent)
 		})(echoMock)
 
 		assert.NoError(t, err)
-		assert.Len(t, hook.Entries, 2)
-		assert.Equal(t, `HTTP request body: "request"`, hook.AllEntries()[0].Message)
-		assert.Equal(t, `HTTP response body: "response"`, hook.AllEntries()[1].Message)
+		assert.Len(t, hook.Entries, 1)
+		assert.Equal(t, "::1", hook.LastEntry().Data["remote_ip"])
+		assert.Equal(t, http.StatusNoContent, hook.LastEntry().Data["status"])
+		assert.Equal(t, "/test", hook.LastEntry().Data["uri"])
 	})
 	t.Run("request and response not loggable", func(t *testing.T) {
 		ctrl := gomock.NewController(t)