bump Go toolchain for CVE-2026-111943

.github/workflows/release-binary.yml

@@ -10,8 +10,12 @@ jobs:
   release: 
     runs-on: ubuntu-latest
     steps: 
-      - uses: actions/checkout@v7
-      - uses: projectdiscovery/actions/setup/go@v1
+      - name: "Check out code"
+        uses: actions/checkout@v7
+        with: 
+          fetch-depth: 0
+      - name: "Set up Go"
+        uses: projectdiscovery/actions/setup/go@v1
       - name: "Create release on GitHub"
         uses: goreleaser/goreleaser-action@v7
         env: 
@@ -20,6 +24,6 @@ jobs:
           DISCORD_WEBHOOK_ID: "${{ secrets.DISCORD_WEBHOOK_ID }}"
           DISCORD_WEBHOOK_TOKEN: "${{ secrets.DISCORD_WEBHOOK_TOKEN }}"
         with: 
-          args: "release --rm-dist"
+          args: "release --clean"
           version: latest
           workdir: .

.goreleaser.yml

@@ -1,3 +1,5 @@
+version: 2
+
 before:
   hooks:
     - go mod tidy
@@ -16,9 +18,8 @@ builds:
         - arm64
 
 archives:
-- format: zip
-  replacements:
-      darwin: macOS
+- formats: [zip]
+  name_template: '{{ .ProjectName }}_{{ .Version }}_{{ if eq .Os "darwin" }}macOS{{ else }}{{ .Os }}{{ end }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}'
 
 checksum:
   algorithm: sha256

Dockerfile

@@ -1,7 +1,12 @@
-FROM golang:1.27.0-alpine as build-env
-RUN go install -v github.com/projectdiscovery/simplehttpserver/cmd/simplehttpserver@latest
+# Pinning apk package versions breaks the build once Alpine drops them; the base image tag is the pin.
+# hadolint global ignore=DL3018
+FROM golang:1.27.3-alpine AS build-env
+RUN apk add --no-cache git
+WORKDIR /app
+COPY . /app
+RUN go mod download && go build ./cmd/simplehttpserver
 
-FROM alpine:latest
+FROM alpine:3.24
 RUN apk add --no-cache bind-tools ca-certificates
-COPY --from=build-env /go/bin/simplehttpserver /usr/local/bin/simplehttpserver
-ENTRYPOINT ["simplehttpserver"]
+COPY --from=build-env /app/simplehttpserver /usr/local/bin/simplehttpserver
+ENTRYPOINT ["simplehttpserver"]

README.md

@@ -36,7 +36,7 @@ SimpleHTTPserver is a go enhanced version of the well known python simplehttpser
 
 # Installing SimpleHTTPserver
 
-SimpleHTTPserver requires **go1.17+** to install successfully. Run the following command to get the repo - 
+SimpleHTTPserver requires **go1.26.10+** to install successfully. Run the following command to get the repo - 
 
 ```sh
 go install -v github.com/projectdiscovery/simplehttpserver/cmd/simplehttpserver@latest

go.mod

@@ -1,6 +1,6 @@
 module github.com/projectdiscovery/simplehttpserver
 
-go 1.25.0
+go 1.26.10
 
 require (
 	github.com/fsnotify/fsnotify v1.10.1

internal/runner/watchdog.go

@@ -25,8 +25,8 @@ func watchFile(fname string, callback WatchEvent) (watcher *fsnotify.Watcher, er
 						log.Println("err", err)
 					}
 				}
-			case <-watcher.Errors:
-				// ignore errors for now
+			case err := <-watcher.Errors:
+				log.Println("err", err)
 			}
 		}
 	}()