Rebuild qmax-code releases with Go 1.27.3

.github/workflows/ci.yml

@@ -14,6 +14,8 @@ jobs:
       id-token: write # Codecov OIDC upload; no stored token needed
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup Go
         uses: actions/setup-go@v5
@@ -25,9 +27,9 @@ jobs:
         run: go build ./...
 
       - name: Lint
-        # Build with the project's Go toolchain; the v1 release binary was
-        # built with Go 1.24 and cannot analyze this module's Go 1.25 target.
-        run: go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run
+        # v2 supports the current Go export format. Limit its upgraded rule set
+        # to this change until the pre-existing v2 findings are cleaned up.
+        run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 run --new-from-rev=${{ github.event.pull_request.base.sha || github.event.before }}
 
       - name: Vet
         run: go vet ./...

AGENTS.md

@@ -9,7 +9,7 @@ standalone on a local repository or connected to QualityMax. Through `/orch`
 it can launch Claude Code, Codex, Antigravity, or OpenCode while keeping qmax tools and
 terminal UX — or run the built-in loop on Anthropic, Cerebras, or Ollama.
 
-This repository is **Go 1.25.13+**, not TypeScript. The thing users install is one
+This repository is **Go 1.27.3+**, not TypeScript. The thing users install is one
 compiled binary.
 
 ## Positioning

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to qmax-code. Versions follow [Semantic Versioning](https://
 
 ## [Unreleased]
 
+## [1.40.1] - 2026-10-22
+
+### Security
+- Rebuild release binaries with Go 1.27.3 so `crypto/x509` rejects the
+  compromised emSign root certificates covered by GO-2026-6809.
+
 ## [1.40.0] - 2026-10-17
 
 ### Changed

CLAUDE.md

@@ -1,6 +1,6 @@
 # CLAUDE.md
 
-qmax-code is a **Go** terminal **QA** agent (Go 1.25.13+). It ships as one
+qmax-code is a **Go** terminal **QA** agent (Go 1.27.3+). It ships as one
 compiled binary: `curl | bash` installs a file, not a Node or Python runtime.
 Claude Code, Codex, Antigravity, and OpenCode are separate subprocesses that `/orch` can
 host; they are not this repository's runtime.

CONTRIBUTING.md

@@ -26,7 +26,7 @@ Thanks for your interest in improving `qmax-code`. This document covers everythi
 
 | Requirement | Notes |
 |---|---|
-| **Go 1.25.13+** | See `go.mod` for the exact version. `go version` to check. |
+| **Go 1.27.3+** | See `go.mod` for the exact version. `go version` to check. |
 | **Inference backend** | The direct API path needs an Anthropic key. You can instead develop against a logged-in Claude Code/Codex/Antigravity CLI, an enabled OpenCode provider, Cerebras, or Ollama. |
 | **QualityMax account** | Required only for connected cloud tools (test generation, crawl, repo review). Standalone `--local` development and most unit tests do not need one. |
 

README.md

@@ -20,7 +20,7 @@
 [![Latest release](https://img.shields.io/github/v/release/Quality-Max/qmax-code?label=release&color=217a45)](https://github.com/Quality-Max/qmax-code/releases/latest)
 [![GitHub downloads](https://img.shields.io/github/downloads/Quality-Max/qmax-code/total?label=downloads)](https://github.com/Quality-Max/qmax-code/releases)
 [![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
-[![Made with Go](https://img.shields.io/badge/made%20with-Go%201.25.13+-00ADD8.svg)](https://go.dev/)
+[![Made with Go](https://img.shields.io/badge/made%20with-Go%201.27.3+-00ADD8.svg)](https://go.dev/)
 [![Go Reference](https://pkg.go.dev/badge/github.com/Quality-Max/qmax-code.svg)](https://pkg.go.dev/github.com/Quality-Max/qmax-code)
 [![Announcement](https://img.shields.io/badge/announcement-Apache%202.0-7c6cf0.svg)](docs/releases/v1.38.0.md)
 
@@ -137,7 +137,7 @@ go build -o qmax-code .
 ./qmax-code --version
 ```
 
-Go 1.25.13 or newer is required for source builds.
+Go 1.27.3 or newer is required for source builds.
 
 ## Why Go
 

doc.go

@@ -10,7 +10,7 @@
 //
 //	curl -sL https://qualitymax.io/static/install-qmax-code.txt | bash
 //
-// Or build from source with Go 1.25.13 or newer:
+// Or build from source with Go 1.27.3 or newer:
 //
 //	go install github.com/Quality-Max/qmax-code@latest
 //

docs/releases/v1.40.1.md

@@ -0,0 +1,8 @@
+# qmax-code v1.40.1
+
+This security release rebuilds qmax-code with Go 1.27.3. That Go release makes
+`crypto/x509` reject the compromised emSign root certificates described in
+[GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809), including on systems whose
+root store has not yet removed them.
+
+Users of earlier qmax-code binaries should upgrade to v1.40.1.

go.mod

@@ -1,6 +1,6 @@
 module github.com/Quality-Max/qmax-code
 
-go 1.25.13
+go 1.27.3
 
 require (
 	github.com/BourgeoisBear/rasterm v1.1.2

main.go

@@ -22,7 +22,7 @@ import (
 )
 
 // Version is set at build time via -ldflags "-X main.Version=x.y.z"
-var Version = "1.40.0"
+var Version = "1.40.1"
 
 const Name = "qmax-code"