Context
Surfaced while moving the Go pin off 1.26.5 to clear the standard-library advisories that were failing the vulnerability scan. That bump landed in #33 at 1.26.7 rather than at the current release, for the reason below.
Problem
The Go pin cannot advance to the current release. Go 1.27.0 is out, but the pinned golangci-lint is built against Go 1.26 and refuses a 1.27 target:
can't load config: the Go language version (go1.26) used to build golangci-lint
is lower than the targeted Go version (1.27.0)
golangci-lint 2.13.0 and 2.13.1 both add go1.27 support, so the fix exists upstream — but mise's built-in minimum_release_age guard hides both, and the pinned toolchain therefore cannot install either yet. Nothing in this repository sets that guard; it is a mise default.
Advancing only the CI half is not available. .claude/rules/toolchain-ci-parity.md binds the golangci-lint pin in mise.toml and the golangci-lint-action version: input in .github/workflows/ci.yml as one atomic value, and nothing detects a mismatch between them — so a CI-only bump would trade a visible red report for silent local/CI drift.
While this holds, the Toolchain currency workflow fails every week. It compares each pin against the latest release rather than against the latest patch of the pinned minor, so it reports go 1.26.7 -> 1.27.0 and exits non-zero.
Evidence
mise outdated --bump --local reports go 1.26.7 -> 1.27.0.- Upstream
golangci/golangci-lint#6643 ("go1.27 support") closed 2026-08-19; released in v2.13.0 (2026-08-19) and v2.13.1 (2026-08-20).
mise ls-remote golangci-lint@2.13 returns nothing, with WARN 2 newer golangci-lint releases hidden by minimum_release_age.- Pinned at Go 1.27.0 locally, every gate passed except
just lint — just vuln, just test-race, just tidy-check, just build, and just release-check were all green, and mise outdated returned empty, confirming 1.27.0 would clear the currency report.
Suggested approaches
Once mise's release-age window clears 2.13.x, move both pins in one change: mise.toml, go.mod, mise.lock, and the version: input in .github/workflows/ci.yml. Verify with the full local gate — just lint is the check that actually exercises the compatibility, and it is the one that failed here.
If the window turns out to be long enough to matter, minimum_release_age_excludes can scope an exception per tool. That trades a supply-chain control for a report that is red for a known and accepted reason, which is worth weighing rather than assuming: v2.13.0 needed a fast-follow inside a day.
Context
Surfaced while moving the Go pin off 1.26.5 to clear the standard-library advisories that were failing the vulnerability scan. That bump landed in #33 at 1.26.7 rather than at the current release, for the reason below.
Problem
The Go pin cannot advance to the current release. Go 1.27.0 is out, but the pinned golangci-lint is built against Go 1.26 and refuses a 1.27 target:
golangci-lint 2.13.0 and 2.13.1 both add go1.27 support, so the fix exists upstream — but mise's built-in
minimum_release_ageguard hides both, and the pinned toolchain therefore cannot install either yet. Nothing in this repository sets that guard; it is a mise default.Advancing only the CI half is not available.
.claude/rules/toolchain-ci-parity.mdbinds the golangci-lint pin inmise.tomland thegolangci-lint-actionversion:input in.github/workflows/ci.ymlas one atomic value, and nothing detects a mismatch between them — so a CI-only bump would trade a visible red report for silent local/CI drift.While this holds, the Toolchain currency workflow fails every week. It compares each pin against the latest release rather than against the latest patch of the pinned minor, so it reports
go 1.26.7 -> 1.27.0and exits non-zero.Evidence
mise outdated --bump --localreportsgo 1.26.7 -> 1.27.0.golangci/golangci-lint#6643("go1.27 support") closed 2026-08-19; released in v2.13.0 (2026-08-19) and v2.13.1 (2026-08-20).mise ls-remote golangci-lint@2.13returns nothing, withWARN 2 newer golangci-lint releases hidden by minimum_release_age.just lint—just vuln,just test-race,just tidy-check,just build, andjust release-checkwere all green, andmise outdatedreturned empty, confirming 1.27.0 would clear the currency report.Suggested approaches
Once mise's release-age window clears 2.13.x, move both pins in one change:
mise.toml,go.mod,mise.lock, and theversion:input in.github/workflows/ci.yml. Verify with the full local gate —just lintis the check that actually exercises the compatibility, and it is the one that failed here.If the window turns out to be long enough to matter,
minimum_release_age_excludescan scope an exception per tool. That trades a supply-chain control for a report that is red for a known and accepted reason, which is worth weighing rather than assuming: v2.13.0 needed a fast-follow inside a day.