From 4b415c0ec179ad4560de7a6fadee351a591199ed Mon Sep 17 00:00:00 2001
From: zzwong <6979793+zzwong@users.noreply.github.com>
Date: Tue, 20 Oct 2026 20:53:27 -0400
Subject: [PATCH] fix: build with Go 1.26.10 for the eMudhra CA distrust

Pin the Go toolchain to 1.26.10, which distrusts the compromised eMudhra intermediate keys (CVE-2026-111943), and read the Go version from go.mod in every setup-go step.
---
 .github/workflows/release.yml | 2 +-
 go.mod                        | 2 ++
 mise.toml                     | 4 ++--
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 43b6ae5..ea756de 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.24'
+          go-version-file: go.mod
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
diff --git a/go.mod b/go.mod
index 00d89a5..885e7a2 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/open-cli-collective/cpm
 
 go 1.25.0
 
+toolchain go1.26.10
+
 require (
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/glamour v0.10.0
diff --git a/mise.toml b/mise.toml
index f1795ae..0da2175 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,6 +1,6 @@
 [tools]
-go = "1.25"
-"aqua:golangci/golangci-lint" = "2.9.0"
+go = "1.26.10"
+"aqua:golangci/golangci-lint" = "2.15.0"
 "aqua:mvdan/gofumpt" = "0.9.2"
 "go:golang.org/x/tools/gopls" = "latest"
 lefthook = "1.11.5"