Take the semantic-release 25.0.9 and Go 1.26.9 security fixes on the shared release and validation paths #625

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

An upstream release review on 2026-10-17 found two tool versions with published security fixes that no update automation will deliver here. Both are hard-coded in files Dependabot does not read as dependencies.

• semantic-release is pinned as npx semantic-release@25.0.3 in create-release.yaml (two places) and in ci.yaml's self-test. The latest release is 25.0.9. According to its release notes, 25.0.6 through 25.0.9 mask encoded secrets and key, auth and webhook variables in output, fix an argument injection through repositoryUrl, block template syntax in branch and tag expansion, and stop printing the authenticated repository URL in a permission error. create-release.yaml cuts releases for every consumer repository with an App token in its environment.
• Go 1.26.9 (2026-10-08) carries security fixes in the go command, crypto/tls, html/template, net/http, net/textproto and os. Still behind are actions/create-issues-from-todos/action.yaml (go-version: 1.26.8) and the go directives of the shipped validate-naming (1.26.6), validate-retired-repo-links and validate-shell-pipelines actions and the delete-workflow-runs driver (1.26.8). Those modules install exactly that patch through go-version-file, inside consumer CI.

Class of failure removed

A release run, or a shipped validation action in consumer CI, executes a toolchain with a published, fixed weakness. The everyday path for consumers is unchanged: same inputs, same outputs, no new setting.

Direction

One fix: change, so consumers receive it through the normal release:

• move all three semantic-release pins together to 25.0.9;
• move the hard-coded Go version and each module's go directive to 1.26.9.

Acceptance criteria

• No file pins semantic-release below 25.0.9, and the create-release dry-run self-tests pass at the new version.
• Every fixed compiler selector on the shipped and catalogue-validation Go 1.26 paths selects at least 1.26.9; the scanner installer and 1.27 test matrix select 1.27.2, and the affected native action jobs pass. Compatibility-only language declarations and the retained 1.25 compatibility matrix do not establish patched compiler adoption.
• Released as a patch, so Dependabot carries it to consumers.
• The structural cause, pins no automation tracks, stays with Make every version the catalogue runs both immutable and tracked by update automation #627, not this one.

Priority rationale: security fixes on the organization-wide release path and in actions that run in every Go consumer's CI. The change is small. Effort: low; CI runs only the affected jobs. Prerequisites: none.