From 43b08bcafbb2405b6fbb46eae6ae6bb1f367a2ff Mon Sep 17 00:00:00 2001
From: Zongqi Chen <137198879+zongqichen@users.noreply.github.com>
Date: Mon, 2 Nov 2026 14:35:25 +0100
Subject: [PATCH] ci: keep Go security patches current

---
 .github/workflows/ci.yml      | 8 ++++++--
 .github/workflows/release.yml | 3 ++-
 CHANGELOG.md                  | 6 ++++++
 README.md                     | 2 +-
 SECURITY.md                   | 8 +++++---
 go.mod                        | 2 +-
 6 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76b14f3..7584048 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,7 @@
 name: CI
 
 env:
-  GO_VERSION: "1.27.2"
+  GO_VERSION: "1.27.x"
   CF_CLI_VERSION: "8.19.0"
   CF_CLI_LINUX_X86_64_SHA256: "98268ab3134bb3a1c97ffce797b4e6d35590a82e006cd098ad7a29f0a5cae7d8"
   CF_CLI_MACOS_X86_64_SHA256: "7a1ea3ff7b34a42ed1db72475693ca01675cd9297c4d9f5981eb77af2f673471"
@@ -35,6 +35,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Check formatting
         shell: bash
@@ -56,7 +57,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.8"
+          go-version-file: go.mod
           cache: false
       - name: Test
         run: go test ./...
@@ -73,6 +74,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Check release builds
         run: make release-check
@@ -100,6 +102,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Install checksum-pinned CF CLI
         shell: bash
@@ -152,6 +155,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Check vulnerabilities and secrets
         run: make security
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 97ceebf..b23037c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,7 +50,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.27.2"
+          go-version: "1.27.x"
+          check-latest: true
           cache: false
 
       - name: Validate tagged commit
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ada11c6..5e1669d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ contract may still change while cfs is pre-1.0.
 
 ## [Unreleased]
 
+### Security
+
+- CI and release builds now select the latest Go 1.27 patch to pick up
+  standard library security fixes, including GO-2026-6809 in Go 1.27.3.
+- Source builds now require Go 1.26.10 or newer, which also fixes GO-2026-6809.
+
 ## [0.4.0] - 2026-10-06
 
 ### Added
diff --git a/README.md b/README.md
index 1ee9050..bf79acf 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ Already using environment variables or another context manager?
 ## Quick start
 
 Install the [official CF CLI](https://github.com/cloudfoundry/cli), then install
-`cfs` with Go 1.26.8+:
+`cfs` with Go 1.26.10+:
 
 ```sh
 go install github.com/zongqichen/cloud-foundry-cli-contexts/cmd/cfs@latest
diff --git a/SECURITY.md b/SECURITY.md
index 9b8bb3f..f516f17 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -56,6 +56,8 @@ organization, and space. They remove `CF_TRACE` from the probe environment and
 never intentionally request tokens. Prefer their `--json --redact` form in
 agent logs, issue reports, and other shared output.
 
-Official release binaries are built with Go 1.27.1. Source installations require
-Go 1.26.8 or newer so the minimum supported toolchain includes the standard
-library fixes current when this policy was written.
+The CI and release workflows select the latest Go 1.27 patch with
+`check-latest: true`, so each run picks up available standard library security
+fixes. Source installations require Go 1.26.10 or newer. Use the latest patch
+of a supported Go release when building from source. The minimum-version CI job
+reads its Go version from `go.mod`.
diff --git a/go.mod b/go.mod
index 2949d51..4c152e2 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/zongqichen/cloud-foundry-cli-contexts
 
-go 1.26.8
+go 1.26.10
 
 require (
 	golang.org/x/mod v0.41.0