Bump mise toolchain and Go module dependencies

mise tools (.tool-versions):
- go 1.26.3 -> 1.26.4 (fixes CVE-2026-42504 net/textproto error
  injection, CVE-2026-42507 mime CPU exhaustion, CVE-2026-27145
  crypto/x509 VerifyHostname DoS — all on the CLI's HTTPS client path)
- goreleaser 2.15.2 -> 2.16.0 (brews: deprecated; we already use
  homebrew_casks — goreleaser check validates clean)
- cosign 3.0.6 -> 3.1.1 (bundle-format default; verify-blob unchanged)
- syft 1.42.4 -> 1.45.1
- caddy 2.11.2 -> 2.11.4 (security patches)

Go modules:
- bubbletea v2.0.7, koanf v2.3.5, x/crypto v0.53.0, x/mod v0.37.0,
  x/term v0.44.0 (direct)
- btcec v2.5.0, btcutil v1.2.0, fsnotify v1.10.1, x/sys v0.46.0,
  new chainhash/v2 module via btcec (indirect)

No breaking changes per upstream changelogs. Verified with tests
between each update group, task precommit-full (fmt, lint, race,
fuzz seeds, govulncheck clean, all-platform builds), and task
fuzz-deep across all 64 targets with no new reproducers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: grempe

.tool-versions

@@ -2,18 +2,18 @@
 # Bump intentionally after vetting the upstream changelog; do not let
 # the stdlib (or any other tool below) drift under the project via `latest`.
 #
-# Go 1.26.3 is the minimum: 1.26.2 carries two stdlib vulnerabilities
-# (GO-2026-4971 panic in net.Dial/LookupPort on Windows NUL bytes;
-# GO-2026-4918 infinite loop in net/http/internal/http2 on bad
-# SETTINGS_MAX_FRAME_SIZE) surfaced by `task vuln-check`. Prior 1.26.1
-# carried six stdlib vulnerabilities (5 in crypto/x509, 1 in html/template).
-# Re-run `task vuln-check` after every Go bump.
-go 1.26.3
-goreleaser 2.15.2
-cosign 3.0.6
+# Go 1.26.4 is the current pin (`task vuln-check` clean as of 2026-06-11).
+# 1.26.3 was the previous security floor: 1.26.2 carried two stdlib
+# vulnerabilities (GO-2026-4971 panic in net.Dial/LookupPort on Windows
+# NUL bytes; GO-2026-4918 infinite loop in net/http/internal/http2 on bad
+# SETTINGS_MAX_FRAME_SIZE); 1.26.1 carried six (5 in crypto/x509, 1 in
+# html/template). Re-run `task vuln-check` after every Go bump.
+go 1.26.4
+goreleaser 2.16.0
+cosign 3.1.1
 shellcheck 0.11.0
-syft 1.42.4
-caddy 2.11.2
+syft 1.45.1
+caddy 2.11.4
 # Go quality and vulnerability tooling consumed by `task lint` (staticcheck +
 # gosec) and `task vuln-check` (govulncheck). Pinning via mise — rather than
 # `go install ...@latest` — keeps these reproducible across machines and

CHANGELOG.md

@@ -7,6 +7,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- **Go toolchain 1.26.3 → 1.26.4.** Picks up three stdlib CVE fixes
+  that all sit on this CLI's HTTPS client path: CVE-2026-42504
+  (net/textproto — attacker-controlled server could inject unescaped
+  content into errors surfaced by net/http clients reading MIME
+  headers), CVE-2026-42507 (mime — CPU exhaustion decoding malicious
+  MIME headers), and CVE-2026-27145 (crypto/x509 — quadratic
+  `VerifyHostname` cost on large DNS SAN lists during TLS
+  verification). `task vuln-check` is clean on 1.26.4.
+
+### Changed
+- **Toolchain pins bumped in `.tool-versions`** after vetting each
+  upstream changelog: goreleaser 2.15.2 → 2.16.0 (XZ archive support,
+  secret-redaction hardening in 2.15.3; the newly-deprecated `brews:`
+  config section does not affect us — `.goreleaser.yaml` already uses
+  `homebrew_casks`, and `goreleaser check` validates clean), cosign
+  3.0.6 → 3.1.1 (Sigstore bundle format now the default; legacy
+  detached-signature `verify-blob` used by `truestamp upgrade` and
+  `install.sh` keeps working in v3 — flag removals land in cosign v4),
+  syft 1.42.4 → 1.45.1, caddy 2.11.2 → 2.11.4 (upstream security
+  patches; dev-docs server only). shellcheck and websocat were already
+  current.
+- **Go module dependencies updated across the board**: bubbletea
+  v2.0.7 (mouse-handling race fixes that directly benefit
+  `truestamp console`), koanf v2.3.5, x/crypto v0.53.0, x/mod v0.37.0,
+  x/term v0.44.0, and notable indirects btcec v2.5.0 + btcutil v1.2.0
+  (first releases on btcsuite's post-module-split graph — the new
+  `chainhash/v2` module enters the graph via btcec; the breaking
+  `*/v2.0.0` btcsuite line was deliberately *not* taken), fsnotify
+  v1.10.1, x/sys v0.46.0. No breaking changes per upstream release
+  notes. Verified with the full test suite between each update group,
+  `task precommit-full`, and `task fuzz-deep` across all 64 fuzz
+  targets with no new reproducers.
+- **Go lint/vuln tooling pinned via mise** (`staticcheck`, `gosec`,
+  `govulncheck` in `.tool-versions`) instead of `go install ...@latest`,
+  keeping `task lint` and `task vuln-check` reproducible across
+  machines and Go toolchain bumps (#19).
+
 ## [0.8.1] — 2026-05-27
 
 ### Fixed

go.mod

@@ -1,10 +1,10 @@
 module github.com/truestamp/truestamp-cli
 
-go 1.26.3
+go 1.26.4
 
 require (
 	charm.land/bubbles/v2 v2.1.0
-	charm.land/bubbletea/v2 v2.0.6
+	charm.land/bubbletea/v2 v2.0.7
 	charm.land/huh/v2 v2.0.3
 	charm.land/lipgloss/v2 v2.0.3
 	github.com/btcsuite/btcd v0.25.0
@@ -20,47 +20,50 @@ require (
 	github.com/knadh/koanf/providers/env/v2 v2.0.0
 	github.com/knadh/koanf/providers/file v1.2.1
 	github.com/knadh/koanf/providers/posflag v1.0.1
-	github.com/knadh/koanf/v2 v2.3.4
+	github.com/knadh/koanf/v2 v2.3.5
 	github.com/oklog/ulid/v2 v2.1.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	golang.org/x/crypto v0.52.0
-	golang.org/x/mod v0.36.0
-	golang.org/x/term v0.43.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/mod v0.37.0
+	golang.org/x/term v0.44.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 )
 
 require (
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/btcsuite/btcd/btcec/v2 v2.3.5 // indirect
-	github.com/btcsuite/btcd/btcutil v1.1.5 // indirect
-	github.com/btcsuite/btclog v0.0.0-20170628155309-84c8d2346e9f // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260416155717-489999b90468 // indirect
+	github.com/btcsuite/btcd/btcec/v2 v2.5.0 // indirect
+	github.com/btcsuite/btcd/btcutil v1.2.0 // indirect
+	github.com/btcsuite/btcd/chainhash/v2 v2.0.0 // indirect
+	github.com/btcsuite/btclog v1.0.0 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260608091853-35bcb7319efa // indirect
 	github.com/charmbracelet/x/ansi v0.11.7 // indirect
 	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
-	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
+	github.com/charmbracelet/x/exp/strings v0.1.0 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/decred/dcrd/crypto/blake256 v1.0.0 // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 // indirect
+	github.com/decred/dcrd/crypto/blake256 v1.1.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/kcalvinalvin/anet v0.0.0-20251112173137-d8ddc1f6dbee // indirect
 	github.com/knadh/koanf/maps v0.1.2 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
+	github.com/mattn/go-runewidth v0.0.24 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 )