From e65b05a9b0ab47e7a0a2ac8e5037d9d592b66b90 Mon Sep 17 00:00:00 2001
From: John Coffey <johnellis@linux.com>
Date: Sun, 13 Sep 2026 22:23:39 -0700
Subject: [PATCH] Build with Go 1.26.8

The first release run stopped at govulncheck: go.mod named 1.26.5, so
the workflow built with it, and 1.26.5 carries four standard-library
vulnerabilities the tool reaches (net/url GO-2026-6218, crypto/tls
GO-2026-6090, encoding/asn1 GO-2026-5972, net/http GO-2026-5026), all
fixed in 1.26.6. 1.26.8 is the current patch release; govulncheck is
clean on it, and it is also the minimum for building from source.
---
 README.md | 2 +-
 go.mod    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 53915dc..5a1bffb 100644
--- a/README.md
+++ b/README.md
@@ -183,7 +183,7 @@ same bytes from the same commit.
 
 ### From source
 
-With Go 1.26 or newer:
+With Go 1.26.8 or newer:
 
 ```bash
 git clone https://github.com/Coffey-Labs/ihasmail-oneshot.git
diff --git a/go.mod b/go.mod
index a962c50..bc930cd 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
 module github.com/Coffey-Labs/ihasmail-oneshot
 
-go 1.26.5
+go 1.26.8