From 8abeac479699c4ee520d7f34e5088f3a9f66662e Mon Sep 17 00:00:00 2001 From: Ruslan Strazhnyk Date: Thu, 22 Oct 2026 21:22:22 +0200 Subject: [PATCH 1/3] fix(security): rebuild releases with Go 1.27.3 --- AGENTS.md | 2 +- CHANGELOG.md | 6 ++++++ CLAUDE.md | 2 +- CONTRIBUTING.md | 2 +- README.md | 4 ++-- doc.go | 2 +- docs/releases/v1.40.1.md | 8 ++++++++ go.mod | 2 +- main.go | 2 +- 9 files changed, 22 insertions(+), 8 deletions(-) create mode 100644 docs/releases/v1.40.1.md diff --git a/AGENTS.md b/AGENTS.md index 4612161..1164b68 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -9,7 +9,7 @@ standalone on a local repository or connected to QualityMax. Through `/orch` it can launch Claude Code, Codex, Antigravity, or OpenCode while keeping qmax tools and terminal UX — or run the built-in loop on Anthropic, Cerebras, or Ollama. -This repository is **Go 1.25.13+**, not TypeScript. The thing users install is one +This repository is **Go 1.27.3+**, not TypeScript. The thing users install is one compiled binary. ## Positioning diff --git a/CHANGELOG.md b/CHANGELOG.md index 977c72c..69ba8ca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to qmax-code. Versions follow [Semantic Versioning](https:// ## [Unreleased] +## [1.40.1] - 2026-10-22 + +### Security +- Rebuild release binaries with Go 1.27.3 so `crypto/x509` rejects the + compromised emSign root certificates covered by GO-2026-6809. + ## [1.40.0] - 2026-10-17 ### Changed diff --git a/CLAUDE.md b/CLAUDE.md index 2538099..a9edc77 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,6 +1,6 @@ # CLAUDE.md -qmax-code is a **Go** terminal **QA** agent (Go 1.25.13+). It ships as one +qmax-code is a **Go** terminal **QA** agent (Go 1.27.3+). It ships as one compiled binary: `curl | bash` installs a file, not a Node or Python runtime. Claude Code, Codex, Antigravity, and OpenCode are separate subprocesses that `/orch` can host; they are not this repository's runtime. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index dba9ea0..e4859cd 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -26,7 +26,7 @@ Thanks for your interest in improving `qmax-code`. This document covers everythi | Requirement | Notes | |---|---| -| **Go 1.25.13+** | See `go.mod` for the exact version. `go version` to check. | +| **Go 1.27.3+** | See `go.mod` for the exact version. `go version` to check. | | **Inference backend** | The direct API path needs an Anthropic key. You can instead develop against a logged-in Claude Code/Codex/Antigravity CLI, an enabled OpenCode provider, Cerebras, or Ollama. | | **QualityMax account** | Required only for connected cloud tools (test generation, crawl, repo review). Standalone `--local` development and most unit tests do not need one. | diff --git a/README.md b/README.md index 8c83f3e..eef4262 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ [![Latest release](https://img.shields.io/github/v/release/Quality-Max/qmax-code?label=release&color=217a45)](https://github.com/Quality-Max/qmax-code/releases/latest) [![GitHub downloads](https://img.shields.io/github/downloads/Quality-Max/qmax-code/total?label=downloads)](https://github.com/Quality-Max/qmax-code/releases) [![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE) -[![Made with Go](https://img.shields.io/badge/made%20with-Go%201.25.13+-00ADD8.svg)](https://go.dev/) +[![Made with Go](https://img.shields.io/badge/made%20with-Go%201.27.3+-00ADD8.svg)](https://go.dev/) [![Go Reference](https://pkg.go.dev/badge/github.com/Quality-Max/qmax-code.svg)](https://pkg.go.dev/github.com/Quality-Max/qmax-code) [![Announcement](https://img.shields.io/badge/announcement-Apache%202.0-7c6cf0.svg)](docs/releases/v1.38.0.md) @@ -137,7 +137,7 @@ go build -o qmax-code . ./qmax-code --version ``` -Go 1.25.13 or newer is required for source builds. +Go 1.27.3 or newer is required for source builds. ## Why Go diff --git a/doc.go b/doc.go index 6d56eec..89a246b 100644 --- a/doc.go +++ b/doc.go @@ -10,7 +10,7 @@ // // curl -sL https://qualitymax.io/static/install-qmax-code.txt | bash // -// Or build from source with Go 1.25.13 or newer: +// Or build from source with Go 1.27.3 or newer: // // go install github.com/Quality-Max/qmax-code@latest // diff --git a/docs/releases/v1.40.1.md b/docs/releases/v1.40.1.md new file mode 100644 index 0000000..9be9ce8 --- /dev/null +++ b/docs/releases/v1.40.1.md @@ -0,0 +1,8 @@ +# qmax-code v1.40.1 + +This security release rebuilds qmax-code with Go 1.27.3. That Go release makes +`crypto/x509` reject the compromised emSign root certificates described in +[GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809), including on systems whose +root store has not yet removed them. + +Users of earlier qmax-code binaries should upgrade to v1.40.1. diff --git a/go.mod b/go.mod index 7c67459..90425ef 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/Quality-Max/qmax-code -go 1.25.13 +go 1.27.3 require ( github.com/BourgeoisBear/rasterm v1.1.2 diff --git a/main.go b/main.go index 3e242ee..fe2097c 100644 --- a/main.go +++ b/main.go @@ -22,7 +22,7 @@ import ( ) // Version is set at build time via -ldflags "-X main.Version=x.y.z" -var Version = "1.40.0" +var Version = "1.40.1" const Name = "qmax-code" From 590af2833fdb8c1e6b33ec33115c73dc73e34db3 Mon Sep 17 00:00:00 2001 From: Ruslan Strazhnyk Date: Thu, 22 Oct 2026 21:26:32 +0200 Subject: [PATCH 2/3] fix(ci): support Go 1.27 linting --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b7f271f..bf339cf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,9 +25,9 @@ jobs: run: go build ./... - name: Lint - # Build with the project's Go toolchain; the v1 release binary was - # built with Go 1.24 and cannot analyze this module's Go 1.25 target. - run: go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run + # v2 supports the current Go export format. Limit its upgraded rule set + # to this change until the pre-existing v2 findings are cleaned up. + run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 run --new-from-rev=${{ github.event.pull_request.base.sha || github.event.before }} - name: Vet run: go vet ./... From f692b4ce64d32aa5bf8dd03a2cffec28fe1bb8e6 Mon Sep 17 00:00:00 2001 From: Ruslan Strazhnyk Date: Thu, 22 Oct 2026 21:32:41 +0200 Subject: [PATCH 3/3] fix(ci): fetch lint comparison history --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bf339cf..5c2cee7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,6 +14,8 @@ jobs: id-token: write # Codecov OIDC upload; no stored token needed steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 - name: Setup Go uses: actions/setup-go@v5