From 833c831bfa1d3a7b6169244c9090e8d65b3693aa Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 27 Aug 2026 00:32:42 +0000
Subject: [PATCH] chore(deps): update github actions

---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/release.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c97737..f580816 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26"
+          go-version: "1.27"
           # Without this, setup-go keeps the runner image's PREINSTALLED Go when it
           # satisfies the "1.26" range, instead of fetching the newest patch. That
           # silently pins CI to a stale patch release — which govulncheck then reports
@@ -64,7 +64,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.4
+          version: v2.13.1
 
       - name: Run govulncheck
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b477a6a..02da950 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26"
+          go-version: "1.27"
           # Match ci.yml: build released binaries with the newest 1.26 patch rather
           # than whatever the runner image happens to ship, so a release never carries
           # stdlib vulnerabilities CI has already been fixed against.