From 277c005360f979a04958eb5e5cfbe0310f095ca4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 10 Oct 2026 11:43:34 +0000
Subject: [PATCH 1/2] build(deps): bump actions/setup-node

Bumps the github-actions group with 1 update: [actions/setup-node](https://github.com/actions/setup-node).


Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6654a2e..1f81fac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.18.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

From 1fba812608d927af963b888d4376a92494853249 Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Sun, 11 Oct 2026 09:51:01 -0500
Subject: [PATCH 2/2] fix(deps): update Go to 1.26.9 security release

---
 .go-version              | 2 +-
 README.md                | 2 +-
 go.mod                   | 2 +-
 policy/dependencies.json | 2 +-
 tools/validate.sh        | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.go-version b/.go-version
index f250c8f..3cd33cd 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.26.6
+1.26.9
diff --git a/README.md b/README.md
index b94a514..be181c3 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ commands inward and immutable snapshots and committed events travel outward.
 
 ## Build and inspect
 
-Go 1.26.6 is required.
+Go 1.26.9 is required.
 
 ```sh
 go build ./cmd/atrinik-server
diff --git a/go.mod b/go.mod
index a046e5c..e1d5e4f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/atrinik/server
 
-go 1.26.6
+go 1.26.9
 
 require (
 	github.com/atrinik/protocol v1.5.5
diff --git a/policy/dependencies.json b/policy/dependencies.json
index 31b88c7..fa5f748 100644
--- a/policy/dependencies.json
+++ b/policy/dependencies.json
@@ -23,7 +23,7 @@
     "validation": "go mod verify, Linux and Windows go list -deps, govulncheck, go-licenses, tests, Syft release SBOM"
   },
   "tools": [
-    {"name": "Go", "version": "1.26.6", "source": "https://go.dev/dl/", "license": "BSD-3-Clause"},
+    {"name": "Go", "version": "1.26.9", "source": "https://go.dev/dl/", "license": "BSD-3-Clause"},
     {"name": "staticcheck", "version": "0.7.0", "source": "https://pkg.go.dev/honnef.co/go/tools/cmd/staticcheck", "license": "MIT"},
     {"name": "govulncheck", "version": "1.6.0", "source": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck", "license": "BSD-3-Clause"},
     {"name": "go-licenses", "version": "1.6.0", "source": "https://github.com/google/go-licenses", "license": "Apache-2.0"},
diff --git a/tools/validate.sh b/tools/validate.sh
index ccfe5af..ad1b2b8 100755
--- a/tools/validate.sh
+++ b/tools/validate.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 repository=$(git rev-parse --show-toplevel)
 cd "${repository}"
 
-test "$(go version | awk '{print $3}')" = go1.26.6
+test "$(go version | awk '{print $3}')" = go1.26.9
 for command in go staticcheck govulncheck go-licenses jq syft; do
   command -v "${command}" >/dev/null || { echo "missing required tool: ${command}" >&2; exit 1; }
 done