From 940c3272e06009afa400efffb5fefab9c12bc311 Mon Sep 17 00:00:00 2001
From: Blair Hamilton <blairham@me.com>
Date: Sat, 15 Aug 2026 09:00:14 -0400
Subject: [PATCH 1/2] build(go): bump Go to 1.26.6

go1.26.6 fixes the stdlib vulnerabilities GO-2026-6218 (net/url) and
GO-2026-6090 (crypto/tls) flagged by govulncheck. go.mod and
.tool-versions move together per the tree convention.
---
 .tool-versions | 2 +-
 go.mod         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.tool-versions b/.tool-versions
index d5c21c4..14eeea8 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -3,7 +3,7 @@
 # Install all: asdf install
 
 # Go compiler — keep in sync with go.mod and CI workflow
-golang 1.26.2
+golang 1.26.6
 
 # Release tooling
 goreleaser 2.15.3
diff --git a/go.mod b/go.mod
index 82b0f56..3da0793 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/blairham/go-pre-commit/v4
 
-go 1.26.2
+go 1.26.6
 
 require (
 	github.com/charmbracelet/lipgloss v1.1.0

From eed4377e2ff47a1edcbe4bd253ca88d1f3ef2134 Mon Sep 17 00:00:00 2001
From: Blair Hamilton <blairham@me.com>
Date: Sat, 15 Aug 2026 09:08:22 -0400
Subject: [PATCH 2/2] ci: resolve Go 1.26.6 via check-latest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

setup-go pins GOTOOLCHAIN=local and resolves versions from its cached
manifest, which lags fresh Go patch releases — today it still resolves
the 1.26 line to 1.26.5, so every job died on 'go.mod requires
go >= 1.26.6'. check-latest makes setup-go consult go.dev directly.
---
 .github/workflows/ci.yml         | 5 +++++
 .github/workflows/goreleaser.yml | 1 +
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1533920..4fa882c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,7 @@ jobs:
       uses: actions/setup-go@v6
       with:
         go-version: ${{ env.GO_VERSION }}
+        check-latest: true # setup-go's manifest lags fresh Go patch releases; resolve via go.dev
         cache: true
 
     - name: Run tests
@@ -33,6 +34,7 @@ jobs:
       uses: actions/setup-go@v6
       with:
         go-version: ${{ env.GO_VERSION }}
+        check-latest: true # setup-go's manifest lags fresh Go patch releases; resolve via go.dev
         cache: true
 
     - name: Run golangci-lint
@@ -50,6 +52,7 @@ jobs:
       uses: actions/setup-go@v6
       with:
         go-version: ${{ env.GO_VERSION }}
+        check-latest: true # setup-go's manifest lags fresh Go patch releases; resolve via go.dev
         cache: true
 
     - name: Install gofumpt
@@ -70,6 +73,7 @@ jobs:
       uses: actions/setup-go@v6
       with:
         go-version: ${{ env.GO_VERSION }}
+        check-latest: true # setup-go's manifest lags fresh Go patch releases; resolve via go.dev
         cache: true
 
     - name: Build
@@ -88,6 +92,7 @@ jobs:
       uses: actions/setup-go@v6
       with:
         go-version: ${{ env.GO_VERSION }}
+        check-latest: true # setup-go's manifest lags fresh Go patch releases; resolve via go.dev
         cache: true
 
     - name: Set up Python
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 9755da0..1c4b3bc 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -29,6 +29,7 @@ jobs:
       uses: actions/setup-go@v6
       with:
         go-version: ${{ env.GO_VERSION }}
+        check-latest: true # setup-go's manifest lags fresh Go patch releases; resolve via go.dev
         cache: false # replaced by the release-scoped cache below
 
     # Release-scoped Go cache: setup-go's built-in cache is exact-match on