build(deps): move the Go toolchain to 1.26.7

.github/workflows/ci-go.yml

@@ -23,7 +23,7 @@ permissions:
 # Single place to bump these within this workflow. They must stay identical to the pins
 # in mise.toml — the "Verify toolchain pins match mise.toml" step below enforces it.
 env:
-  GO_VERSION: "1.26.5"
+  GO_VERSION: "1.26.7"
   GOLANGCI_LINT_VERSION: "2.12.2"
   GOVULNCHECK_VERSION: "1.6.0"
   BUF_VERSION: "1.66.1"

.github/workflows/security-scan.yml

@@ -36,7 +36,7 @@ permissions:
   issues: write
 
 env:
-  GO_VERSION: "1.26.5"
+  GO_VERSION: "1.26.7"
   GOVULNCHECK_VERSION: "1.6.0"
   PROTOC_GEN_GO_VERSION: "1.36.11"
   PROTOC_GEN_GO_GRPC_VERSION: "1.6.1"

CHANGELOG.md

@@ -30,6 +30,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### Security
 
+- Updated the Go toolchain to 1.26.7, closing two standard-library advisories that finch's own code reaches: a limit on post-handshake messages in `crypto/tls` (GO-2026-6090) and a maximum recursion depth in `encoding/asn1` (GO-2026-5972). Both are reached through the gRPC transport and the protobuf runtime, so the daemon and MCP server were affected.
 - Updated Go dependencies to close four advisories that finch's own code reached: an authorization bypass in gRPC affecting the daemon's request routing (GO-2026-4762), two advisories in the MCP SDK (GO-2026-4773, GO-2026-4770), and an HTTP/2 infinite loop in `golang.org/x/net` (GO-2026-4918). The Go toolchain also moved to 1.26.5, closing eleven standard-library advisories in the daemon and MCP server.
 - Known vulnerabilities in Go dependencies are now detected rather than discovered: `govulncheck` runs on every pull request touching Go code and blocks the merge on an advisory reachable from finch's code, a weekly scheduled scan covers advisories published between changes, and `just vuln` runs the same scan locally. This covers the Go daemon and MCP server; the Qt app's C++ dependencies are not yet in scope.
 - Updated `google.golang.org/grpc` to 1.82.1 and `golang.org/x/net` to 0.57.0 in the daemon and MCP server, which also carries `golang.org/x/text` to 0.40.0 — closing nine advisories. None of the nine was reachable from finch's own code, so this is proactive rather than a repair for exposed behavior: the seven `golang.org/x/net` advisories need HTML, IDNA, or DNS-message parsing that finch does not do (GO-2026-5025 through GO-2026-5030, and GO-2026-5942), and the `golang.org/x/text` one needs a text-processing path finch does not reach (GO-2026-5970). The gRPC advisory has no Go vulnerability database entry, so it is named by its GitHub identifier instead (GHSA-hrxh-6v49-42gf); two of its three impacts are confined to the xDS RBAC authorization engine, which finch does not use, leaving a denial-of-service via an HTTP/2 rapid-reset mitigation bypass in the transport — and the daemon accepts connections only on a Unix socket reachable by the local user.

mise.toml

@@ -4,7 +4,7 @@
 # on stdlib advisories, which makes this a security-relevant pin with an end-of-life
 # clock rather than a compatibility floor. Keep within one minor of current Go, and keep
 # it identical to the go-version in the CI workflows (asserted there).
-go = "1.26.5"
+go = "1.26.7"
 just = "1.57.0"
 buf = "1.66.1"
 "go:google.golang.org/protobuf/cmd/protoc-gen-go" = "1.36.11"