From 406382a6d483d84cf23ab23f5284e4df0d143258 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Mon, 1 Jun 2026 13:32:30 +0100
Subject: [PATCH] fix(ci): bump go.mod toolchain to 1.25.10 to clear
 govulncheck (#8)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security Scan workflow on main failed with 18 standard-library
vulnerabilities (GO-2025-4007..4015, GO-2025-4155, GO-2026-4337,
plus a few more). All are fixed in later 1.25.x patches. Lowest
1.25.x version that govulncheck accepts clean is 1.25.10.

go.sum unchanged — the repo's go.sum already pointed at
oss-telemetry v0.2.3 and go-runewidth v0.0.24, which is what
1.25.10 + tidy resolves to.

Verified locally with GOTOOLCHAIN=go1.25.10:
  - go build ./...            clean
  - go test -count=1 ./...    20/20 packages pass
  - govulncheck ./...         No vulnerabilities found

go-version-file: go.mod in lint.yaml and security.yaml will
auto-pick the new version; no workflow changes needed.
---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 2f34782..d355eba 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/lukaszraczylo/harness-sync
 
-go 1.25.0
+go 1.25.10
 
 require (
 	github.com/charmbracelet/huh v1.0.0