V5.4: Upgrade to Go 1.26.1

.circleci/config.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     parallelism: 8
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26.1
     steps:
       - checkout
 
@@ -37,7 +37,7 @@ jobs:
 
   report:
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26.1
     steps:
       - checkout
       - attach_workspace:

Dockerfile

@@ -1,5 +1,5 @@
 # golang alpine
-FROM golang:1.25.7-alpine AS builder
+FROM golang:1.26.1-alpine AS builder
 
 ARG TARGETARCH
 ARG TARGETOS

docs/pages/release_notes.rst

@@ -3,6 +3,14 @@
 Release notes
 #############
 
+*************************
+Hazelnut update (v5.4.25)
+*************************
+
+Release date: 2026-03-15
+
+- Upgrade to Go 1.26.1 to fix GO-2026-4601, GO-2026-4602 and GO-2026-4603
+
 *************************
 Hazelnut update (v5.4.24)
 *************************

go.mod

@@ -2,7 +2,7 @@ module github.com/nuts-foundation/nuts-node
 
 // This is the minimal version, the actual go version is determined by the images in the Dockerfile
 // This version is used in automated tests such as the 'Scheduled govulncheck' action
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/alicebob/miniredis/v2 v2.33.0

http/requestlogger_test.go

@@ -21,16 +21,17 @@ package http
 import (
 	"bytes"
 	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
 	"github.com/labstack/echo/v4"
 	"github.com/nuts-foundation/nuts-node/core"
 	"github.com/nuts-foundation/nuts-node/mock"
 	"github.com/sirupsen/logrus"
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"go.uber.org/mock/gomock"
-	"net/http"
-	"net/http/httptest"
-	"testing"
 )
 
 func Test_requestLoggerMiddleware(t *testing.T) {
@@ -128,9 +129,9 @@ func Test_bodyLoggerMiddleware(t *testing.T) {
 		response := echo.NewResponse(responseRecorder, e)
 		response.Header().Set("Content-Type", "application/json")
 		echoMock := mock.NewMockContext(ctrl)
-		echoMock.EXPECT().NoContent(http.StatusNoContent).Do(func(status int) {
+		echoMock.EXPECT().String(gomock.Any(), gomock.Any()).Do(func(status int, data string) {
 			response.Status = status
-			response.Write([]byte(`"response"`))
+			response.Write([]byte(data))
 		})
 		echoMock.EXPECT().Request().MinTimes(1).Return(request)
 		echoMock.EXPECT().Response().MinTimes(1).Return(response)
@@ -140,13 +141,13 @@ func Test_bodyLoggerMiddleware(t *testing.T) {
 			return false
 		}, logger.WithFields(logrus.Fields{}))
 		err := logFunc(func(context echo.Context) error {
-			return context.NoContent(http.StatusNoContent)
+			return context.String(http.StatusOK, "response")
 		})(echoMock)
 
 		assert.NoError(t, err)
 		assert.Len(t, hook.Entries, 2)
 		assert.Equal(t, `HTTP request body: "request"`, hook.AllEntries()[0].Message)
-		assert.Equal(t, `HTTP response body: "response"`, hook.AllEntries()[1].Message)
+		assert.Equal(t, `HTTP response body: response`, hook.AllEntries()[1].Message)
 	})
 	t.Run("request and response not loggable", func(t *testing.T) {
 		ctrl := gomock.NewController(t)