From 3b6f38fe8cba335023d5245fda949ec1e124e651 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 27 Jul 2026 21:36:49 +0000
Subject: [PATCH 1/3] Initial plan


From f95e7b495546d1e7a2b19dc0028ce9258daa0330 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 27 Jul 2026 21:43:30 +0000
Subject: [PATCH 2/3] chore: initial plan for Go stdlib security upgrade

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/smoke-copilot-auto.lock.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/smoke-copilot-auto.lock.yml b/.github/workflows/smoke-copilot-auto.lock.yml
index 5207103f95d..ec93a6a2df0 100644
--- a/.github/workflows/smoke-copilot-auto.lock.yml
+++ b/.github/workflows/smoke-copilot-auto.lock.yml
@@ -149,7 +149,7 @@ jobs:
           GH_AW_INFO_FIREWALL_TYPE: "squid"
           GH_AW_INFO_FRONTMATTER_EMOJI: "🌸"
           GH_AW_COMPILED_STRICT: "true"
-          GH_AW_INFO_MODEL_COSTS: '{"providers":{"github-copilot":{"models":{"auto":{"cost":{"input":"8.5e-07","output":"1.55e-06"}}}}}}'
+          GH_AW_INFO_MODEL_COSTS: '{"providers":{"github-copilot":{"models":{"auto":{"cost":{"input":"0","output":"0"}}}}}}'
           GH_AW_INFO_FEATURES: '{"gh-aw-detection":false}'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

From 49e149436c08235fbe4b651b74085ca24f6b3c5d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 27 Jul 2026 21:50:44 +0000
Subject: [PATCH 3/3] fix: upgrade Go to 1.26.5 to resolve stdlib CVEs in
 gh-aw-mcpg container

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .changeset/patch-upgrade-go-1-26-5.md         | 5 +++++
 .github/workflows/smoke-copilot-auto.lock.yml | 1 -
 go.mod                                        | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/patch-upgrade-go-1-26-5.md

diff --git a/.changeset/patch-upgrade-go-1-26-5.md b/.changeset/patch-upgrade-go-1-26-5.md
new file mode 100644
index 00000000000..aa5fc2a0e68
--- /dev/null
+++ b/.changeset/patch-upgrade-go-1-26-5.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Upgrade Go toolchain to 1.26.5 to resolve Critical and High Go stdlib vulnerabilities (CVEs) found in the `ghcr.io/github/gh-aw-mcpg` container image scanned at go1.26.3.
diff --git a/.github/workflows/smoke-copilot-auto.lock.yml b/.github/workflows/smoke-copilot-auto.lock.yml
index ec93a6a2df0..be9291f3ff8 100644
--- a/.github/workflows/smoke-copilot-auto.lock.yml
+++ b/.github/workflows/smoke-copilot-auto.lock.yml
@@ -149,7 +149,6 @@ jobs:
           GH_AW_INFO_FIREWALL_TYPE: "squid"
           GH_AW_INFO_FRONTMATTER_EMOJI: "🌸"
           GH_AW_COMPILED_STRICT: "true"
-          GH_AW_INFO_MODEL_COSTS: '{"providers":{"github-copilot":{"models":{"auto":{"cost":{"input":"0","output":"0"}}}}}}'
           GH_AW_INFO_FEATURES: '{"gh-aw-detection":false}'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
diff --git a/go.mod b/go.mod
index fce36bdcdeb..7b5081531ea 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/github/gh-aw
 
-go 1.26.3
+go 1.26.5
 
 require (
 	charm.land/bubbles/v2 v2.1.1