gerardrecinto · Oct 22, 2026 · Oct 22, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
   # below for why.
   #
   # Go version: the project pins one exact toolchain version in go.mod
-  # (currently 1.26.9, for CVE remediation, see CHANGELOG.md) rather than
+  # (currently 1.26.10, for CVE remediation, see CHANGELOG.md) rather than
   # supporting a range, so this matrix intentionally does not add a Go
   # version axis; `go-version-file: go.mod` picks up that pinned version on
   # every OS.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- Go is bumped to 1.26.10 and 1.27.3, which clears GO-2026-6809 in `crypto/x509` that the govulncheck and Trivy image scans now report against 1.26.9 and 1.27.2.
+
 ## v5.11.1
 
 - The release build for the Linux and Windows libraries pinned Go 1.26.8 and failed against the Go 1.26.9 requirement, so the v5.11.0 packages were not built. This release fixes the pin. It carries everything listed under v5.11.0.

diff --git a/Dockerfile b/Dockerfile
@@ -3,7 +3,7 @@
 # ==============================================================================
 # Stage 1: Builder
 # ==============================================================================
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 # Install build dependencies, CA certificates, and tzdata
 RUN apk add --no-cache ca-certificates tzdata
@@ -42,7 +42,7 @@ RUN mkdir -p /out/var/lib/sop && chown -R 65532:65532 /out/var/lib/sop
 # ==============================================================================
 # Stage 2: Integration Test Runner (Optional Target: --target test)
 # ==============================================================================
-FROM golang:1.27.2-alpine AS test
+FROM golang:1.27.3-alpine AS test
 RUN apk add --no-cache redis
 WORKDIR /app
 COPY --from=builder /src /app

diff --git a/README.md b/README.md
@@ -67,7 +67,7 @@ go run github.com/sharedcode/joltrin/v5/examples/agent_team@latest       # Jira,
 go run github.com/sharedcode/joltrin/v5/examples/quickstart@latest       # the embedded B-Tree that holds the state
 ```
 
-No clone needed, only Go 1.26.9 or newer. An older Go downloads 1.26.9 on its own. The first run downloads the modules and compiles, which took about 10 seconds on a MacBook Air, and later runs are quick. To read the code, or to run `./scripts/demo.sh --memory`, clone the repo.
+No clone needed, only Go 1.26.10 or newer. An older Go downloads 1.26.10 on its own. The first run downloads the modules and compiles, which took about 10 seconds on a MacBook Air, and later runs are quick. To read the code, or to run `./scripts/demo.sh --memory`, clone the repo.
 
 Or skip the install. These run in your browser with no backend:
 
@@ -124,7 +124,7 @@ go install github.com/sharedcode/joltrin/v5/cmd/sop-mcp-server@latest
 "$(go env GOPATH)/bin/sop-mcp-server" setup --apply
 ```
 
-The first `go install` downloads the Go modules, which took about 15 seconds on a MacBook Air. If your Go is older than 1.26.9, Go also downloads that toolchain once, about 240 MB.
+The first `go install` downloads the Go modules, which took about 15 seconds on a MacBook Air. If your Go is older than 1.26.10, Go also downloads that toolchain once, about 240 MB.
 
 </details>
 

diff --git a/adapters/cassandra/go.mod b/adapters/cassandra/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/adapters/cassandra
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/gocql/gocql v1.7.0

diff --git a/adapters/nats/go.mod b/adapters/nats/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/adapters/nats
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/nats-io/nats-server/v2 v2.15.1

diff --git a/adapters/redis/go.mod b/adapters/redis/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/adapters/redis
 
-go 1.26.9
+go 1.26.10
 
 require github.com/redis/go-redis/v9 v9.23.0
 

diff --git a/ai/go.mod b/ai/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/ai
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/google/cel-go v0.30.0

diff --git a/bindings/Dockerfile.build b/bindings/Dockerfile.build
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM golang:1.26.9
+FROM golang:1.26.10
 
 # Install dependencies
 # mingw-w64 is needed for Windows builds if not using Zig for Windows (the script uses x86_64-w64-mingw32-gcc)

diff --git a/deploy/k8s-gate/Dockerfile b/deploy/k8s-gate/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # Build from the repository root: docker build -f deploy/k8s-gate/Dockerfile .
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 WORKDIR /src
 COPY . .
 RUN --mount=type=cache,target=/go/pkg/mod \

diff --git a/docker/Dockerfile.barrier b/docker/Dockerfile.barrier
@@ -7,7 +7,7 @@
 # ==============================================================================
 # Stage 1: Builder
 # ==============================================================================
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 WORKDIR /src
 

diff --git a/docker/Dockerfile.nocov b/docker/Dockerfile.nocov
@@ -3,7 +3,7 @@
 # ==============================================================================
 # Stage 1: Builder
 # ==============================================================================
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 WORKDIR /src
 
@@ -29,7 +29,7 @@ COPY . .
 # ==============================================================================
 # Stage 2: Integration Test Runner (No Coverage)
 # ==============================================================================
-FROM golang:1.27.2-alpine AS build-and-test
+FROM golang:1.27.3-alpine AS build-and-test
 
 # Install Redis server for Alpine
 RUN apk add --no-cache redis

diff --git a/docker/Dockerfile.quickstart b/docker/Dockerfile.quickstart
@@ -6,7 +6,7 @@
 # ==============================================================================
 # Stage 1: Builder
 # ==============================================================================
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 WORKDIR /src
 

diff --git a/docs/AGENT_PROTOCOLS.md b/docs/AGENT_PROTOCOLS.md
@@ -200,5 +200,5 @@ Exit codes are the same everywhere: 0 for success, 1 for a failure, and 2 for a
 - **A block you did not expect.** The result names the rule, the missing state and the steps that establish it. `sop-mcp-server check` shows the runbook's steps and what each needs.
 - **Memory is on but there are no lessons.** Lessons appear once a block has been recorded for the current runbook. A runbook that has changed starts fresh, and entries expire after 30 days.
 - **A call is refused for an id that is too long.** `trace_id`, `idempotency_key`, workflow and step names are limited to 256 bytes.
-- **The first `go install` takes minutes.** It downloads the Go modules, and a Go older than 1.26.9 also downloads a toolchain. The prebuilt binary skips both: see the install command in the README.
+- **The first `go install` takes minutes.** It downloads the Go modules, and a Go older than 1.26.10 also downloads a toolchain. The prebuilt binary skips both: see the install command in the README.
 - **Windows.** Use the `.exe` from the release page and run `setup --apply` from the folder you keep it in, because it registers that path.
diff --git a/docs/GO_CORE_ENGINE.md b/docs/GO_CORE_ENGINE.md
@@ -340,7 +340,7 @@ SOP has all the bits required to be used like a golang map but which, has the fe
 Requirements:
   * Storage Drive(s) or sub-system (paths) for Blobs. Can be **Local Disk** (for standalone/dev) or **Network Mounts** (NAS/S3/Cloud) for distributed clusters.
   * User that you will use for the process which has Read/Write permissions(e.g. - 0777) to the drive(s)/storage path(s)
-  * Golang that supports generics, SOP package (go.mod) currently is set to use 1.26.9 and higher
+  * Golang that supports generics, SOP package (go.mod) currently is set to use 1.26.10 and higher
   * (Optional) Redis - required only for distributed/cluster mode or if using Redis-backed caching.
 
 ## Sample Code

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/v5
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/a2aproject/a2a-go v0.3.15

diff --git a/go.work b/go.work
@@ -1,4 +1,4 @@
-go 1.26.9
+go 1.26.10
 
 use (
 	.

diff --git a/incfs/go.mod b/incfs/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/incfs
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/sharedcode/joltrin/adapters/cassandra v0.1.0

diff --git a/infs/go.mod b/infs/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/infs
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/sharedcode/joltrin/adapters/redis v0.1.0

diff --git a/jsondb/go.mod b/jsondb/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/jsondb
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/google/uuid v1.6.0

diff --git a/search/go.mod b/search/go.mod
@@ -1,6 +1,6 @@
 module github.com/sharedcode/joltrin/search
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/sharedcode/joltrin/infs v0.1.0

diff --git a/tools/httpserver/README.md b/tools/httpserver/README.md
@@ -52,7 +52,7 @@ In a large-scale enterprise environment, the SOP Data Manager shines as a statel
 ## Usage
 
 ### Prerequisites
-- Go 1.26.9+ installed.
+- Go 1.26.10+ installed.
 - Run from the root of the `sop` repository so `go run ./tools/httpserver` resolves the module correctly.
 - Either:
   - an existing SOP database folder for single-database mode, or