[Security/Maintenance] Upgrade Go version from 1.24 to 1.26 (1.24 is End of Life)

[uriparush]

Overview
Currently, Tyk is built using Go 1.24.x. As of February 10, 2026, with the official release of Go 1.26, Go 1.24 has reached its End of Life (EOL) according to the official Go Release Policy.

We need to upgrade the Go toolchain and runtime to a supported version (preferably 1.26, or at minimum 1.25) to ensure Tyk continues to receive critical security patches.

Business & Security Justification

Zero Security Patches: The Go project only supports the two most recent major releases. Go 1.24 will no longer receive any minor revisions for newly discovered CVEs in the standard library, crypto packages, or runtime.

Edge Security Risk: As an API Gateway, Tyk sits at the edge of the network. Running on an unsupported runtime introduces unacceptable security risks for production deployments.

Compliance Blockers: Many enterprise compliance frameworks (like SOC2, ISO 27001, and PCI-DSS) strictly require software to be built and run on vendor-supported, actively patched runtimes. Staying on 1.24 may flag Tyk in automated enterprise security and vulnerability scanners.

[probelabs]

Thank You for Your Contribution!

Hello @uriparush. Thank you for opening this important issue. You've clearly articulated the security and compliance risks associated with using an End-of-Life (EOL) Go runtime. We agree that this is a critical maintenance task that needs to be addressed.

Triage & Analysis

• Category: This is a maintenance task, so we'll categorize it as a chore.
• Priority: High. Running on an unsupported runtime is a significant security risk, especially for a component like an API Gateway.
• Complexity: Moderate. While the change itself might seem simple, it requires careful updates across the codebase and thorough testing to ensure there are no regressions or unexpected behavior from the toolchain upgrade.

Next Steps

The core of this work involves updating the Go version across our build and development environments. The key areas that will likely need changes are:

• go.mod: The module definition file.
• Dockerfiles: Any Dockerfiles used for building or development (Dockerfile, ci/Dockerfile.std, etc.).
• CI/CD Pipelines: Configuration files for our continuous integration workflows (e.g., in the .github/workflows directory) that specify the Go version for build and test jobs.

After updating the Go version in all relevant files, the full test suite must be run to validate the changes.

We appreciate you bringing this to our attention. The team will review this as part of our regular maintenance and security process.

References

• None

---

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>