From 77235bd0fa1be0ec294ecf3c95785aea6ebaefb5 Mon Sep 17 00:00:00 2001
From: JackDoan <me@jackdoan.com>
Date: Tue, 8 Sep 2026 14:53:33 -0500
Subject: [PATCH] Require Go 1.26.3+: earlier releases break TLS under
 fips140=only

Under GODEBUG=fips140=only, Go < 1.26.3 fails every TLS handshake while
generating the default X25519MLKEM768 key share (golang/go#78372):

    crypto/ecdh: use of X25519 is not allowed in FIPS 140-only mode

so a FIPS-enforced client cannot reach the Defined Networking API at all.
Pin the minimum toolchain to the first release with the upstream fix.
---
 go.mod | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 16a4dcd..9d0691c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,8 @@
 module github.com/DefinedNet/dnapi
 
-go 1.26.0
+// 1.26.3+ required: earlier point releases fail every TLS handshake under
+// fips140=only, generating the default X25519MLKEM768 key share (golang/go#78372)
+go 1.26.3
 
 require (
 	github.com/slackhq/nebula v1.11.0