Security: rebuilt with Go 1.26.10
This release contains no functional changes. The binaries are rebuilt with Go 1.26.10, up from 1.26.0, to pick up the standard library security fixes shipped since.
The one most worth knowing about is the eMudhra CA compromise (CVE-2026-111943). In October 2026 the private keys of eight eMudhra intermediate certificate authorities were found to be recoverable from their public certificates, which would let anyone issue a certificate for any domain that chains through them. Go 1.26.10 adds a denylist to crypto/x509 so verification fails for any chain containing one of those intermediates.
- Linux: the binary checks TLS certificates against your distribution's CA bundle. If that bundle still trusts the affected roots, the previous release would have accepted a forged certificate for any server it connects to, including the GitHub release check. This build rejects them regardless of the bundle. Upgrade.
- macOS and Windows: Go hands certificate checks to the operating system's verifier on these platforms, and Apple and Microsoft already block the affected certificates, so the previous release was not exposed. Upgrading is still worthwhile for the other fixes.