From c0cc68d626de0b09a4005eb66ba8293d103a408c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 21 Oct 2026 14:15:46 +0000
Subject: [PATCH] ci: build and test with Go 1.26.10 to clear stdlib
 vulnerabilities

govulncheck fails on Go 1.26.6 with 10 reachable standard library
vulnerabilities (net/http, net/textproto, crypto/tls fixed in 1.26.9;
crypto/x509 GO-2026-6809 fixed in 1.26.10). The fix is the toolchain, not
a module, so Dependabot (gomod only) never proposes it. Bumping the pin in
release.yml also means released binaries ship the patched standard library.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRc1axJoxMwiK5nm2q7YqP
---
 .github/workflows/acceptance.yml     |  4 ++--
 .github/workflows/outpost-live.yml   |  2 +-
 .github/workflows/release.yml        |  8 ++++----
 .github/workflows/test-npm-build.yml |  2 +-
 .github/workflows/test.yml           | 10 +++++-----
 5 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/acceptance.yml b/.github/workflows/acceptance.yml
index 6cc9815c..4c99744e 100644
--- a/.github/workflows/acceptance.yml
+++ b/.github/workflows/acceptance.yml
@@ -101,7 +101,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.10"
 
       - name: Run Go Acceptance Tests (slice ${{ matrix.slice }})
         # 30m, not 12m: slice 0 timed out at exactly 720s once the MCP tests
@@ -133,7 +133,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.10"
 
       - name: Run telemetry acceptance tests
         run: go test -tags=telemetry ./test/acceptance/... -v -timeout 12m
diff --git a/.github/workflows/outpost-live.yml b/.github/workflows/outpost-live.yml
index 56396bf3..c267d90c 100644
--- a/.github/workflows/outpost-live.yml
+++ b/.github/workflows/outpost-live.yml
@@ -30,7 +30,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.10"
 
       # The tests skip themselves when the key is absent, which is right for a
       # developer machine and wrong here: a missing secret would turn this job
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3da3b883..4825dc1b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -56,7 +56,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -76,7 +76,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -151,7 +151,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
 
       - name: Build npm binaries with GoReleaser
         uses: goreleaser/goreleaser-action@v5
diff --git a/.github/workflows/test-npm-build.yml b/.github/workflows/test-npm-build.yml
index cb6e7285..a1c055e2 100644
--- a/.github/workflows/test-npm-build.yml
+++ b/.github/workflows/test-npm-build.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 46c613ef..c1648b9f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run unit tests
         run: go test -short ./pkg/...
       # `go test` runs a reduced vet suite (printf, bools, atomic and a few
@@ -50,7 +50,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run govulncheck
         # Pinned rather than @latest: a new govulncheck release could change
         # behaviour or fail this job with no change to the repo. Bump
@@ -70,7 +70,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -102,7 +102,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
@@ -121,7 +121,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.6
+          go-version: 1.26.10
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with: