fix(security): build with go1.26.4 to clear stdlib advisories

.github/workflows/act-image-repin.yml

@@ -103,7 +103,7 @@ jobs:
         if: steps.resolve.outputs.changed == 'true'
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.25"
+          go-version-file: e2e/go.mod
 
       - name: Verify e2e module builds
         if: steps.resolve.outputs.changed == 'true'

.github/workflows/build-cli.yaml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Build binary

.github/workflows/nightly-release.yaml

@@ -205,7 +205,7 @@ jobs:
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         if: github.event.inputs.dry_run == 'true'
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Compute candidate version (dry run)
         id: version

.github/workflows/pr.yaml

@@ -53,7 +53,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run unit tests
@@ -89,7 +89,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run golangci-lint
@@ -111,7 +111,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Build cascade CLI

.github/workflows/release.yaml

@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Run tests
         run: go test -v ./...
@@ -70,7 +70,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

.github/workflows/validate.yaml

@@ -41,7 +41,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run tests
@@ -73,17 +73,31 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
           cache: true
 
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.10.1
 
+  vuln:
+    name: Vulnerability Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...
+
   validate:
     name: Validation Gate
-    needs: [test, lint]
+    needs: [test, lint, vuln]
     runs-on: ubuntu-latest
     outputs:
       result: ${{ steps.result.outputs.result }}

docs/release-verification.md

@@ -81,7 +81,7 @@ cd cascade
 git checkout v0.X.Y
 ```
 
-2. Ensure Go 1.25 is installed (the version used for official releases).
+2. Ensure Go 1.26.4 or newer is installed (the toolchain pinned in `go.mod` via the `toolchain` directive, used for official releases).
 
 3. Build with the same flags used in the release workflow:
 

docs/src/content/docs/adoption.md

@@ -18,7 +18,7 @@ The flow in one line: you write a manifest plus callback workflows, run `cascade
 - **GitHub Actions enabled** on the repository, with trunk-based development (a single primary branch).
 - **Conventional Commits are required.** cascade derives the semver bump, the changelog, and breaking-change detection entirely from Conventional Commit messages. This is not optional. Commits that do not follow the convention are not processed correctly and version derivation can fail. See [Versioning and schema compatibility](/cascade/versioning/).
 - **GitHub setup**: environments for each deploy stage, branch and tag protection, the secrets your callbacks consume, and scoped tokens. The [Security and Hardening](/cascade/security/hardening/) checklist is the authoritative list; wire it up before your first production promotion.
-- The `cascade` CLI for local generation (Go 1.25+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/).
+- The `cascade` CLI for local generation (Go 1.26.4+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/).
 
 ## Build a pipeline from scratch
 

docs/src/content/docs/getting-started.md

@@ -7,7 +7,7 @@ This guide walks through setting up `cascade` in your repository. For the big pi
 
 ## Prerequisites
 
-- Go 1.25+ (for the CLI)
+- Go 1.26.4+ (for the CLI)
 - A GitHub repository with Actions enabled
 - Trunk-based development (single primary branch)
 

e2e/go.mod

@@ -2,6 +2,8 @@ module github.com/stablekernel/cascade/e2e
 
 go 1.25.0
 
+toolchain go1.26.4
+
 replace github.com/stablekernel/cascade => ../
 
 require (

go.mod

@@ -2,6 +2,8 @@ module github.com/stablekernel/cascade
 
 go 1.25
 
+toolchain go1.26.4
+
 require (
 	github.com/pmezard/go-difflib v1.0.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2