From 8ebf3e7364044158eced16971615d0f650eaa44c Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 7 Sep 2026 06:37:37 +0000
Subject: [PATCH] chore(deps): update github actions

---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/release.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c977375..8d05b982 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26"
+          go-version: "1.27"
           # Without this, setup-go keeps the runner image's PREINSTALLED Go when it
           # satisfies the "1.26" range, instead of fetching the newest patch. That
           # silently pins CI to a stale patch release — which govulncheck then reports
@@ -64,7 +64,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.4
+          version: v2.13.2
 
       - name: Run govulncheck
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b477a6ad..02da950c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26"
+          go-version: "1.27"
           # Match ci.yml: build released binaries with the newest 1.26 patch rather
           # than whatever the runner image happens to ship, so a release never carries
           # stdlib vulnerabilities CI has already been fixed against.