ci: keep Go security patches current

.github/workflows/ci.yml

@@ -1,7 +1,7 @@
 name: CI
 
 env:
-  GO_VERSION: "1.27.2"
+  GO_VERSION: "1.27.x"
   CF_CLI_VERSION: "8.19.0"
   CF_CLI_LINUX_X86_64_SHA256: "98268ab3134bb3a1c97ffce797b4e6d35590a82e006cd098ad7a29f0a5cae7d8"
   CF_CLI_MACOS_X86_64_SHA256: "7a1ea3ff7b34a42ed1db72475693ca01675cd9297c4d9f5981eb77af2f673471"
@@ -35,6 +35,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Check formatting
         shell: bash
@@ -56,7 +57,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.8"
+          go-version-file: go.mod
           cache: false
       - name: Test
         run: go test ./...
@@ -73,6 +74,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Check release builds
         run: make release-check
@@ -100,6 +102,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Install checksum-pinned CF CLI
         shell: bash
@@ -152,6 +155,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache: false
       - name: Check vulnerabilities and secrets
         run: make security

.github/workflows/release.yml

@@ -50,7 +50,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.27.2"
+          go-version: "1.27.x"
+          check-latest: true
           cache: false
 
       - name: Validate tagged commit

CHANGELOG.md

@@ -7,6 +7,12 @@ contract may still change while cfs is pre-1.0.
 
 ## [Unreleased]
 
+### Security
+
+- CI and release builds now select the latest Go 1.27 patch to pick up
+  standard library security fixes, including GO-2026-6809 in Go 1.27.3.
+- Source builds now require Go 1.26.10 or newer, which also fixes GO-2026-6809.
+
 ## [0.4.0] - 2026-10-06
 
 ### Added

README.md

@@ -24,7 +24,7 @@ Already using environment variables or another context manager?
 ## Quick start
 
 Install the [official CF CLI](https://github.com/cloudfoundry/cli), then install
-`cfs` with Go 1.26.8+:
+`cfs` with Go 1.26.10+:
 
 ```sh
 go install github.com/zongqichen/cloud-foundry-cli-contexts/cmd/cfs@latest

SECURITY.md

@@ -56,6 +56,8 @@ organization, and space. They remove `CF_TRACE` from the probe environment and
 never intentionally request tokens. Prefer their `--json --redact` form in
 agent logs, issue reports, and other shared output.
 
-Official release binaries are built with Go 1.27.1. Source installations require
-Go 1.26.8 or newer so the minimum supported toolchain includes the standard
-library fixes current when this policy was written.
+The CI and release workflows select the latest Go 1.27 patch with
+`check-latest: true`, so each run picks up available standard library security
+fixes. Source installations require Go 1.26.10 or newer. Use the latest patch
+of a supported Go release when building from source. The minimum-version CI job
+reads its Go version from `go.mod`.

go.mod

@@ -1,6 +1,6 @@
 module github.com/zongqichen/cloud-foundry-cli-contexts
 
-go 1.26.8
+go 1.26.10
 
 require (
 	golang.org/x/mod v0.41.0