fix: build against Go 1.26.6 to clear four reachable stdlib advisories

.github/workflows/ci.yml

@@ -101,6 +101,16 @@ jobs:
         # is the same mutable-upstream exposure the SHA-pinned actions above
         # exist to remove. Dependabot does not manage `go install` versions, so
         # this one is bumped by hand.
+        #
+        # When this step fails on a commit that changed no code, suspect the
+        # Go standard library before suspecting the diff. `setup-go` resolves
+        # the toolchain from the `go` directive in go.mod and GOTOOLCHAIN is
+        # `local`, so CI builds against exactly that patch release and reports
+        # every stdlib advisory filed against it. Three landed against 1.26.5
+        # five days after the last green run and turned main red on a
+        # goreleaser-config change. The fix in that case is to bump the patch
+        # version in go.mod to the release named in `Fixed in:`, which is why
+        # that directive carries a patch version at all.
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
           govulncheck ./...

CHANGELOG.md

@@ -9,6 +9,16 @@ Releases before `0.2.0` predate this file. Their notes are on the
 
 ## [Unreleased]
 
+### Security
+- The Go toolchain moves to 1.26.6, clearing four standard-library
+  advisories that `govulncheck` found reachable from this binary:
+  `GO-2026-6218` (quadratic complexity in `net/url.resolvePath`),
+  `GO-2026-6090` (unbounded post-handshake messages in `crypto/tls`),
+  `GO-2026-5972` (recursion depth in `encoding/asn1`), and `GO-2026-5026`
+  (ASCII-only Punycode labels in `net/http`'s IDNA handling). Three were
+  filed on 2026-08-13, after the last green build; no code here changed.
+  Building now needs Go 1.26.6.
+
 ## [0.2.3] - 2026-08-02
 
 ### Added

CONTRIBUTING.md

@@ -9,7 +9,10 @@ Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md).
 
 ## Development setup
 
-Requires Go 1.26+ and Python 3 (only for `make generate`).
+Requires Go 1.26.6+ and Python 3 (only for `make generate`). The `go`
+directive in `go.mod` carries a patch version because CI's `govulncheck`
+step resolves the toolchain from it — see the comment on that step in
+`.github/workflows/ci.yml`.
 
 ```bash
 git clone https://github.com/patramsey/namecom-cli.git

go.mod

@@ -1,6 +1,6 @@
 module github.com/patramsey/namecom-cli
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/charmbracelet/huh v1.0.0