[zongqichen]

Summary

Scheduled CI fails because Go 1.27.2 is affected by GO-2026-6809. CI and release builds now select the latest Go 1.27 patch with check-latest: true, so they pick up security patches even when a runner has an older version cached.

Raise the minimum source toolchain to Go 1.26.10, which also fixes the vulnerability, and read the minimum-version CI job from go.mod. Update the installation and security documentation.

Validation

Validated locally with Go 1.27.3 and temporary user and CF state directories.

GitHub CI and CodeQL passed, including the official CF CLI E2E jobs on Linux and macOS. setup-go resolved 1.27.x to Go 1.27.3.

• make check
• make release-check
• make security
• make smoke is not applicable because shim behavior is unchanged.

Checklist

• Existing checks and updated documentation cover the change.
• The security changes are recorded under Unreleased in CHANGELOG.md.
• No credentials, tokens, CF configuration, or sensitive logs are included.
• The change is focused and does not publish a release.