From ef3f1ca089737b5e345ad50cd85a5da71b67315a Mon Sep 17 00:00:00 2001 From: nicodes Date: Mon, 21 Sep 2026 16:03:40 -0600 Subject: [PATCH] chore(tools): mise go 1.27.0, govulncheck 1.7.0 Convergence wave pin bump. go.mod keeps its 1.25.13 minimum, so the "Toolchain pins agree" guard still holds (pin >= mod). Local go vet and go test are green on 1.27.0. --- .mise.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.mise.toml b/.mise.toml index a6d0990..a373730 100644 --- a/.mise.toml +++ b/.mise.toml @@ -10,10 +10,10 @@ # # The "Toolchain pins agree" step in ci.yml is what stops that happening again. # If you bump go.mod, bump this too; CI will tell you if you forget. -go = "1.25.13" +go = "1.27.0" # The supply-chain scanner CI runs against the binary: `govulncheck ./...` in # .github/actions/test. It reports only vulnerabilities on a path the code # actually calls, so a green run means no reachable CVE, not merely that go.sum # is current. Pinned like the toolchain so the check is reproducible. -"go:golang.org/x/vuln/cmd/govulncheck" = "1.6.0" +"go:golang.org/x/vuln/cmd/govulncheck" = "1.7.0"