jordane · Oct 14, 2026
@@ -2,6 +2,18 @@
 # SPDX-License-Identifier: MIT
 ---
 GITHUB_COMMENT_REPORTER: false
+# The image's bundled Go can lag security patches. Select and download the
+# checksum-verified toolchain from go.mod before any linters run, for both
+# GitHub Actions and local MegaLinter runs. Propagate it to linter subprocesses.
+PRE_COMMANDS:
+  - command: |-
+      set -eu
+      export GOTOOLCHAIN="go$(awk '$1 == "go" { print $2; exit }' go.mod)"
+      go version
+    cwd: workspace
+    continue_if_failed: false
+    output_variables:
+      - GOTOOLCHAIN
 DISABLE_LINTERS:
   # Prefer Revive.
   - GO_GOLANGCI_LINT

@@ -240,10 +240,11 @@ release binaries may be missing even though the GitHub Release exists.
    latest available *patch* release (e.g. `1.X.Y` → `1.X.{Y+1}`) to pick up
    security fixes. Do **not** bump the *minor* version (e.g. `1.X.x` →
    `1.{X+1}.x`) unless the user explicitly asks for it, **and** you've
-   validated it against the Go version MegaLinter itself bundles --
-   MegaLinter runs several linters (e.g. `golangci-lint`) against its own
-   bundled Go version, and a `go.mod` directive newer than that bundled
-   version breaks those checks.
+   validated it against the effective Go runtime and Go-based linters used
+   by MegaLinter. `.mega-linter.yml` selects `GOTOOLCHAIN` from `go.mod` in a
+   fail-closed pre-command, downloads it with Go's checksum verification,
+   and propagates it to linter subprocesses. This keeps CI and local
+   MegaLinter runs on the patched runtime even when the image lags behind.
 
    To find MegaLinter's bundled Go version:
 
@@ -258,11 +259,14 @@ release binaries may be missing even though the GitHub Release exists.
      | grep -i 'GO_ALPINE_VERSION\|GO_IMAGE_VERSION'
    ```
 
-   `go.mod`'s `go` directive must never exceed that bundled version. Staying
-   one minor version behind it (rather than matching its minor *and* patch
-   exactly) leaves room to always take the latest patch release for security
-   fixes without ever being blocked by MegaLinter's own bundled patch version
-   lagging behind a newly disclosed vulnerability.
+   The bundled version is only the bootstrap runtime; the effective runtime
+   must meet `go.mod`'s requirement. Go-based linters also have their own
+   build-toolchain constraints, so upgrading the runtime alone does not
+   guarantee linter compatibility. `GO_GOLANGCI_LINT` is currently disabled
+   in MegaLinter; validate its build-toolchain compatibility before enabling
+   it. Keep the pinned Revive compatible and verify the full MegaLinter run
+   when upgrading Go. Do not keep an unsupported Go minor version solely
+   to stay behind the image's bundled runtime.
 
    There's no built-in `go` subcommand to look up the latest patch release
    for a given minor version -- query the official `go.dev/dl` JSON feed

@@ -83,6 +83,10 @@ Run `lfx --help` or `lfx <command> --help` for full details on any command.
 
 ## Development
 
+Use Go 1.26.9 or newer (see `go.mod`). Build and release workflows read this
+version from `go.mod`; MegaLinter also selects and downloads that toolchain
+before linting, so local MegaLinter runs require network access on first use.
+
 ```bash
 make build   # Build ./bin/lfx
 make check   # Format, vet, and lint

@@ -2,14 +2,14 @@
 // SPDX-License-Identifier: MIT
 module github.com/linuxfoundation/lfx-cli
 
-go 1.25.14
+go 1.26.9
 
 require (
 	github.com/99designs/keyring v1.2.2
-	github.com/tidwall/gjson v1.19.0
+	github.com/tidwall/gjson v1.20.0
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.13.0
-	golang.org/x/oauth2 v0.36.0
+	github.com/urfave/cli/v3 v3.14.0
+	golang.org/x/oauth2 v0.37.0
 )
 
 require (
@@ -22,7 +22,7 @@ require (
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/tidwall/match v1.2.0 // indirect
-	github.com/tidwall/pretty v1.2.1 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
+	github.com/tidwall/pretty v1.2.2 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.47.0 // indirect
 )
@@ -25,23 +25,23 @@ github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
-github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
-github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
+github.com/tidwall/gjson v1.20.0 h1:+agJ3rEzKcCXKDKo0ml26UROcpcAlnZyjq+TjbY5Fto=
+github.com/tidwall/gjson v1.20.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
 github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=
 github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
-github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.2 h1:dz1jrRuE7or/74V490B4/GP1pZm5WKlt2bgCP5A83w8=
+github.com/tidwall/pretty v1.2.2/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.13.0 h1:Dr6jqMfIyyFsRVn7Nz5mqLsMY+ZMpfh3a0aMs+umPVY=
-github.com/urfave/cli/v3 v3.13.0/go.mod h1:vXn6HxPNccJSzQr2QvwVncOKrgYGIHU0HY5h8B2nQj4=
+github.com/urfave/cli/v3 v3.14.0 h1:a8414NQlHJs0c/iBsulKLzlES0n/lEAskbL2LKpU4/s=
+github.com/urfave/cli/v3 v3.14.0/go.mod h1:vXn6HxPNccJSzQr2QvwVncOKrgYGIHU0HY5h8B2nQj4=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b h1:QRR6H1YWRnHb4Y/HeNFCTJLFVxaq6wH4YuVdsUOr75U=
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=