V6.1: Upgrade to Go 1.26.1

.circleci/config.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     parallelism: 8
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26.1
     steps:
       - checkout
 
@@ -37,7 +37,7 @@ jobs:
 
   report:
     docker:
-      - image: cimg/go:1.25
+      - image: cimg/go:1.26.1
     steps:
       - checkout
       - attach_workspace:

Dockerfile

@@ -1,5 +1,5 @@
 # golang alpine
-FROM golang:1.25.7-alpine AS builder
+FROM golang:1.26.1-alpine AS builder
 
 ARG TARGETARCH
 ARG TARGETOS
@@ -17,7 +17,7 @@
 COPY go.sum .
 RUN go mod download && go mod verify
 
 COPY . .
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine

docs/pages/release_notes.rst

@@ -2,6 +2,16 @@
 Release notes
 #############
 
+****************
+Peanut (v6.1.13)
+****************
+
+Release date: 2026-03-15
+
+- Upgrade to Go 1.26.1 to fix GO-2026-4601, GO-2026-4602 and GO-2026-4603
+
+**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v6.1.12...v6.1.13
+
 ****************
 Peanut (v6.1.12)
 ****************

go.mod

@@ -2,7 +2,7 @@ module github.com/nuts-foundation/nuts-node
 
 // This is the minimal version, the actual go version is determined by the images in the Dockerfile
 // This version is used in automated tests such as the 'Scheduled govulncheck' action
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0

http/requestlogger_test.go

@@ -21,6 +21,10 @@ package http
 import (
 	"bytes"
 	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
 	"github.com/labstack/echo/v4"
 	"github.com/nuts-foundation/nuts-node/core"
 	"github.com/nuts-foundation/nuts-node/mock"
@@ -29,9 +33,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
-	"net/http"
-	"net/http/httptest"
-	"testing"
 )
 
 func Test_requestLoggerMiddleware(t *testing.T) {
@@ -130,9 +131,9 @@ func Test_bodyLoggerMiddleware(t *testing.T) {
 		response := echo.NewResponse(responseRecorder, e)
 		response.Header().Set("Content-Type", "application/json")
 		echoMock := mock.NewMockContext(ctrl)
-		echoMock.EXPECT().NoContent(http.StatusNoContent).Do(func(status int) {
+		echoMock.EXPECT().String(gomock.Any(), gomock.Any()).Do(func(status int, data string) {
 			response.Status = status
-			response.Write([]byte(`"response"`))
+			response.Write([]byte(data))
 		})
 		echoMock.EXPECT().Request().MinTimes(1).Return(request)
 		echoMock.EXPECT().Response().MinTimes(1).Return(response)
@@ -142,13 +143,13 @@ func Test_bodyLoggerMiddleware(t *testing.T) {
 			return false
 		}, logger.WithFields(logrus.Fields{}))
 		err := logFunc(func(context echo.Context) error {
-			return context.NoContent(http.StatusNoContent)
+			return context.String(http.StatusOK, "response")
 		})(echoMock)
 
 		assert.NoError(t, err)
 		assert.Len(t, hook.Entries, 2)
 		assert.Equal(t, `HTTP request body: "request"`, hook.AllEntries()[0].Message)
-		assert.Equal(t, `HTTP response body: "response"`, hook.AllEntries()[1].Message)
+		assert.Equal(t, `HTTP response body: response`, hook.AllEntries()[1].Message)
 	})
 	t.Run("request and response not loggable", func(t *testing.T) {
 		ctrl := gomock.NewController(t)