[zzwong]

Add toolchain go1.26.10 to every Go module so CI and release builds use Go 1.26.10. Go 1.26.10 and 1.27.3 add a crypto/x509 distrust of the compromised eMudhra intermediate keys (CVE-2026-111943), which applies whatever root store the binary verifies against. Binaries built with earlier releases still accept certificates issued through those keys on Linux, where verification uses the system roots.

actions/setup-go uses the toolchain directive in preference to the go directive, so builds, tests and releases all pick it up. The go language version is unchanged.

Verification

GOTOOLCHAIN=go1.26.10 go build ./... passes for every module.

[github-actions]

PR Build

Version: 0.3.9-pr.45+e4cb6f6

Platform	Archive
Linux (amd64)	cpm-linux-amd64
Linux (arm64)	cpm-linux-arm64
macOS (universal)	cpm-macos-universal
Windows (amd64)	cpm-windows-amd64

Download artifacts

Built from 4b415c0

[monit-reviewer]

Automated PR Review

Reviewed commit: b74748e3e7c4
Profile: claude-monit-reviewer - Posting as: monit-reviewer

Summary

Reviewer	Findings
automation:ci-release	1
go:implementation-tests	0

automation:ci-release (1 finding)

Minor - go.mod:5

The PR says actions/setup-go picks up this toolchain directive for builds, tests and releases, but that is only true for arch-package.yml (go-version-file). release.yml hardcodes go-version: '1.24', and ci.yml/pr-artifacts.yml install Go through jdx/mise-action with go = "1.25" in mise.toml. Neither reads go.mod. The 1.26.10 build only happens because the installed go auto-switches via GOTOOLCHAIN=auto and downloads 1.26.10 at run time. The release binaries should still get the fix, but that is implicit and depends on a network download in the release job. Nothing checks that the shipped binary was built with >= 1.26.10, and the Go version now lives in three places (go.mod, mise.toml, release.yml). Fix: change release.yml to go-version-file: go.mod (matching arch-package.yml), and add a step after the build, or a Make/CI check, that fails unless go version reports 1.26.10 or newer.

Reviewer Coverage

• automation:ci-release — complete (broad); skipped: none; constraints: Reviewed only the go.mod diff plus workflow/mise.toml context; did not run builds or the Go toolchain download.
• go:implementation-tests — complete (broad); skipped: none; constraints: Did not run a build; go.mod diff is a single toolchain go1.26.10 line (go 1.25.0 unchanged), valid because the toolchain version is >= the go directive. release.yml pins setup-go to 1.24, but with default GOTOOLCHAIN=auto Go switches to the go.mod toolchain, so no finding; that file is outside the assignment.

Inspected files (1)

• go.mod

0 PR discussion threads considered. 0 summarized; 0 resolved.

---

Completed in 3m 47s | ~$0.64 (est.) | claude-sonnet-5-5 | cr 0.10.325

Field	Value
Model	claude-sonnet-5-5
Reviewers	automation:ci-release, go:implementation-tests
Engine	claude_cli · claude-sonnet-5-5
Reviewed by	cr · monit-reviewer
Duration	3m 47s wall · 4m 59s compute
Cost	~$0.64 (est.)
Pricing basis	baseline-2026-10-02/pricing
Tokens	40 in / 6.0k out

Per-workstream usage

• orchestrator-selection — claude-sonnet-5-5
  • In: 6
  • Out: 1.0k
  • Cache read: 44.5k
  • Cache create: 36.8k
  • Cost: ~$0.17 (est.)
  • Duration: 14s
• automation:ci-release — claude-sonnet-5-5
  • In: 16
  • Out: 2.9k
  • Cache read: 212.4k
  • Cache create: 37.7k
  • Cost: ~$0.22 (est.)
  • Duration: 2m 01s
• go:implementation-tests — claude-sonnet-5-5
  • In: 12
  • Out: 1.5k
  • Cache read: 140.2k
  • Cache create: 34.2k
  • Cost: ~$0.18 (est.)
  • Duration: 1m 35s
• orchestrator-rollup — claude-sonnet-5-5
  • In: 6
  • Out: 500
  • Cache read: 119.8k
  • Cache create: 9.9k
  • Cost: ~$0.07 (est.)
  • Duration: 1m 09s