3leaps · 3leapsdave · Jul 29, 2026 · Jul 29, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26.4'
+          go-version: '1.26.5'
 
       - name: Install system tools
         run: |
@@ -38,7 +38,7 @@ jobs:
       - name: Install goneat via sfetch (dogfooding)
         run: |
           ./bin/sfetch --repo fulmenhq/goneat \
-            --tag v0.5.13 \
+            --tag v0.5.15 \
             --dest-dir bin \
             --require-minisign
           ./bin/goneat version
@@ -75,7 +75,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26.4'
+          go-version: '1.26.5'
 
       - name: Build sfetch (from this commit)
         shell: bash
@@ -94,7 +94,7 @@ jobs:
           export PATH="$BIN_DIR:$PATH"
 
           sfetch --repo fulmenhq/goneat \
-            --tag v0.5.13 \
+            --tag v0.5.15 \
             --dest-dir "$BIN_DIR" \
             --cache-dir "$CACHE_DIR" \
             --require-minisign
@@ -109,7 +109,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26.4'
+          go-version: '1.26.5'
 
       - name: Install minisign
         shell: pwsh
@@ -127,7 +127,7 @@ jobs:
         run: |
           .\bin\sfetch.exe `
             --repo fulmenhq/goneat `
-            --tag v0.5.13 `
+            --tag v0.5.15 `
             --dest-dir bin `
             --require-minisign
           .\bin\goneat.exe version
@@ -140,7 +140,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26.4'
+          go-version: '1.26.5'
 
       - name: Install minisign
         shell: pwsh
@@ -174,7 +174,7 @@ jobs:
         run: |
           .\bin\sfetch.exe `
             --repo fulmenhq/goneat `
-            --tag v0.5.13 `
+            --tag v0.5.15 `
             --dest-dir bin `
             --require-minisign
           .\bin\goneat.exe version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -18,14 +18,15 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      # softprops/action-gh-release@v2 (Node 24) replaces the archived,
-      # Node12-era actions/create-release@v1 + actions/upload-release-asset@v1.
-      # It creates the release for the pushed tag (idempotent) and uploads the
-      # install script. The build matrix below appends per-platform archives to
-      # the same release. Maintainer signs + adds SHA256SUMS/notes afterward via
-      # scripts/ (see README "Manual signing workflow").
+      # softprops/action-gh-release@v3 (Node 24) replaces the archived,
+      # Node12-era actions/create-release@v1 + actions/upload-release-asset@v1
+      # and the Node-20 softprops/action-gh-release@v2 pin. It creates the
+      # release for the pushed tag (idempotent) and uploads the install script.
+      # The build matrix below appends per-platform archives to the same release.
+      # Maintainer signs + adds SHA256SUMS/notes afterward via scripts/
+      # (see README "Manual signing workflow").
       - name: Create release and upload install script
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           name: sfetch ${{ github.ref_name }}
           body: |
@@ -68,7 +69,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26.4'
+          go-version: '1.26.5'
 
       - name: License check
         # go-licenses v1.6.0 errors on stdlib packages ("Package fmt does not
@@ -120,10 +121,10 @@ jobs:
       # Maintainer generates SHA256SUMS locally and signs with minisign/pgp
 
       # Appends this matrix entry's archive to the release created above.
-      # action-gh-release@v2 is idempotent on the tag; parallel matrix jobs each
+      # action-gh-release@v3 is idempotent on the tag; parallel matrix jobs each
       # upload a distinctly-named asset, so no upload_url plumbing is needed.
       - name: Upload Archive
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: ${{ env.ASSET_FILE }}
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,13 +9,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.9] - 2026-07-29
+
+### Changed
+- **Go toolchain pinned to 1.26.5.** `go.mod` now declares `go 1.25.12` with `toolchain go1.26.5`, and CI/release `setup-go` pins `1.26.5`. Clears reachable stdlib advisories (including GO-2026-5856) while remaining inside Go's supported-major window.
+- **Dependencies updated:** `golang.org/x/crypto` v0.53.0 → v0.54.0, `golang.org/x/sys` v0.46.0 → v0.47.0, `golang.org/x/text` v0.38.0 → v0.40.0. Pinned `govulncheck@v1.6.0` on the precommit/CI path reports zero reachable vulnerabilities.
+- **goneat pinned to v0.5.15** (was v0.5.13) across the `Makefile` and all CI dogfood install steps; installed via sfetch with minisign verification.
+- **Release publish action bumped to Node 24.** `softprops/action-gh-release@v2` (Node 20) → `@v3` (Node 24) on both release steps.
+
+### Fixed
+- **Self-bootstrap trust anchor.** `make bootstrap` now passes the installer `--dir` flag (was incorrect `--dest`), pins the binary with `--tag` matching `SFETCH_VERSION` (N-1: v0.4.8), and requires minisign verification. The installer script and installed binary are the same reviewed release.
+- **Unpinned schema CLI removed from precommit.** Corpus validation runs in-repo via `jsonschema/v6` v6.0.2 (the product dependency) instead of network-fetched `cmd/jv@latest`.
+
+### Added
+- **Pinned `govulncheck@v1.6.0` gate** in `make precommit` (and therefore CI Quality).
+
 ## [0.4.8] - 2026-06-22
 
 ### Changed
 - **Go toolchain pinned to 1.26.4.** `go.mod` now declares `go 1.25.5` with `toolchain go1.26.4`, and CI/release `setup-go` pins `1.26.4` (was the floating `1.26`). Default builds (`GOTOOLCHAIN=auto`) transparently use the patched 1.26.4 standard library while the module still builds on Go 1.25.x, keeping us inside Go's supported-major window and clearing the stdlib advisories that source-based vulnerability scans were flagging.
 - **Dependencies updated:** `golang.org/x/crypto` v0.47.0 → v0.53.0, `golang.org/x/text` v0.33.0 → v0.38.0, `golang.org/x/sys` v0.40.0 → v0.46.0, `github.com/dlclark/regexp2` v1.11.5 → v1.12.0, and `github.com/jedisct1/go-minisign` refreshed to its latest commit. `govulncheck ./...` reports no vulnerabilities.
 - **goneat pinned to v0.5.13** (was v0.5.10) across the `Makefile` and the CI dogfood install steps.
-- **Release workflow migrated off archived Node12 actions.** `actions/create-release@v1` and `actions/upload-release-asset@v1` (both archived, Node12-era) are replaced with `softprops/action-gh-release@v2` (Node 24), completing the Node 20 → 24 runner transition begun in v0.4.7 (which had already moved `checkout`/`setup-go`).
+- **Release workflow migrated off archived Node12 actions.** `actions/create-release@v1` and `actions/upload-release-asset@v1` (both archived, Node12-era) are replaced with `softprops/action-gh-release@v2` (Node 20). Checkout and setup-go had already moved to Node 24-era majors in v0.4.7.
 
 ### Added
 - **Pinned YAML formatting standard.** Added repo-root `.yamlfmt` and `.yamllint` so goneat's bundled yamlfmt and any standalone yamlfmt agree on inline-comment padding (two spaces) and document-start handling. Ends the intermittent `make precommit`/CI churn on workflow and config files. The config preserves sfetch's `---` + blank-line house style rather than collapsing it.
@@ -138,15 +153,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 - Block URL credentials by default to avoid leaking user info during redirects.
 
-## [0.3.4] - 2026-01-10
-
-### Added
-- **Proxy support:** New `--http-proxy`, `--https-proxy`, and `--no-proxy` flags with environment variable overrides (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) for proxied networks.
-- **Proxy validation tests:** Added coverage for proxy URL validation and env overrides.
-
-### Documentation
-- Documented proxy support in `README.md`.
-
 ---
 
 > **Maintenance note:** This file is pruned to the latest 10 releases. For older entries, see `docs/releases/`.
+
+[Unreleased]: https://github.com/3leaps/sfetch/compare/v0.4.9...HEAD
+[0.4.9]: https://github.com/3leaps/sfetch/compare/v0.4.8...v0.4.9
+[0.4.8]: https://github.com/3leaps/sfetch/compare/v0.4.7...v0.4.8
+[0.4.7]: https://github.com/3leaps/sfetch/compare/v0.4.6...v0.4.7
+[0.4.6]: https://github.com/3leaps/sfetch/compare/v0.4.5...v0.4.6
+[0.4.5]: https://github.com/3leaps/sfetch/compare/v0.4.4...v0.4.5
+[0.4.4]: https://github.com/3leaps/sfetch/compare/v0.4.3...v0.4.4
+[0.4.3]: https://github.com/3leaps/sfetch/compare/v0.4.2...v0.4.3
+[0.4.2]: https://github.com/3leaps/sfetch/compare/v0.4.1...v0.4.2
+[0.4.1]: https://github.com/3leaps/sfetch/compare/v0.4.0...v0.4.1
+[0.4.0]: https://github.com/3leaps/sfetch/compare/v0.3.4...v0.4.0
diff --git a/Makefile b/Makefile
@@ -40,9 +40,10 @@ SCOOP_BUCKET_REPO ?= https://github.com/3leaps/scoop-bucket.git
 # Tool installation directory (repo-local)
 BIN_DIR := $(CURDIR)/bin
 
-# Pinned tool versions (minimums; existing installs are respected)
-SFETCH_VERSION := v0.3.4
-GONEAT_VERSION ?= v0.5.13
+# Pinned tool versions (every gate/release tool is version-pinned; no @latest)
+SFETCH_VERSION := v0.4.8
+GONEAT_VERSION ?= v0.5.15
+GOVULNCHECK_VERSION ?= v1.6.0
 
 # Tool paths (sfetch bootstrap may land in bin/; goneat must be on PATH)
 SFETCH = $(shell [ -x "$(BIN_DIR)/sfetch" ] && echo "$(BIN_DIR)/sfetch" || command -v sfetch 2>/dev/null)
@@ -94,7 +95,8 @@ bootstrap: ## Install development tools via trust chain
 	@mkdir -p "$(BIN_DIR)"
 	@if [ ! -x "$(BIN_DIR)/sfetch" ] && ! command -v sfetch >/dev/null 2>&1; then \
 		echo "[..] Installing sfetch $(SFETCH_VERSION) (self-bootstrap)..."; \
-		curl -fsSL https://github.com/3leaps/sfetch/releases/download/$(SFETCH_VERSION)/install-sfetch.sh | bash -s -- --dest "$(BIN_DIR)"; \
+		curl -fsSL https://github.com/3leaps/sfetch/releases/download/$(SFETCH_VERSION)/install-sfetch.sh | bash -s -- \
+			--dir "$(BIN_DIR)" --tag "$(SFETCH_VERSION)" --require-minisign; \
 	else \
 		echo "[ok] sfetch already installed"; \
 	fi
@@ -188,7 +190,7 @@ gosec-high: ## Run gosec (high confidence only)
 precommit: ## Run pre-commit checks (goneat assess + Go tests + build)
 	@command -v goneat >/dev/null 2>&1 || { echo "[!!] goneat not found on PATH"; exit 1; }
 	goneat assess --categories format,lint --check --fail-on critical
-	go run github.com/santhosh-tekuri/jsonschema/cmd/jv@latest testdata/corpus.schema.json testdata/corpus.json
+	go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./...
 	go test -v -race ./...
 	$(MAKE) gosec-high
 	$(MAKE) build-all

diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
@@ -1,7 +1,35 @@
+## v0.4.9
+
+### Summary
+Maintenance release: patches the Go toolchain and selected dependencies, adds a pinned vulnerability gate, hardens the self-bootstrap trust anchor, and moves release publish onto Node 24. No user-facing feature or API changes.
+
+### Highlights
+
+**Toolchain & supply chain**
+- `go.mod` pins `go 1.25.12` + `toolchain go1.26.5`; CI/release build with Go `1.26.5`. Clears reachable stdlib advisories while the module still builds on Go 1.25.x.
+- Updated `golang.org/x/crypto` (v0.54.0), `golang.org/x/sys` (v0.47.0), and `golang.org/x/text` (v0.40.0).
+- Precommit/CI runs pinned `govulncheck@v1.6.0` with zero reachable vulnerabilities as the pass condition.
+
+**CI / release**
+- `softprops/action-gh-release@v2` (Node 20) → `@v3` (Node 24) on both release steps.
+- Pinned goneat to `v0.5.15`, installed via sfetch with minisign verification.
+
+**Bootstrap & gates**
+- `make bootstrap` self-install uses `--dir`, `--tag` (N-1 pin `v0.4.8`), and `--require-minisign` so the script and binary match a reviewed release.
+- Corpus schema validation runs in-repo on `jsonschema/v6` v6.0.2 instead of an unpinned external CLI.
+
+### Install
+
+```bash
+curl -sSfL https://github.com/3leaps/sfetch/releases/latest/download/install-sfetch.sh | bash
+```
+
+---
+
 ## v0.4.8
 
 ### Summary
-Maintenance release: refreshes the Go toolchain and dependencies, completes the GitHub Actions Node 20 → 24 migration, bumps goneat, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes.
+Maintenance release: refreshes the Go toolchain and dependencies, retires archived Node12 release Actions in favor of softprops/action-gh-release@v2, bumps goneat, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes.
 
 ### Highlights
 
@@ -10,7 +38,7 @@ Maintenance release: refreshes the Go toolchain and dependencies, completes the
 - Updated `golang.org/x/crypto`, `golang.org/x/text`, `golang.org/x/sys`, `github.com/dlclark/regexp2`, and `github.com/jedisct1/go-minisign`. `govulncheck ./...` is clean.
 
 **CI / release**
-- Replaced the archived Node12 `actions/create-release@v1` + `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 24), completing the runner transition started in v0.4.7.
+- Replaced the archived Node12 `actions/create-release@v1` + `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 20). Checkout and setup-go had already moved to Node 24-era majors in v0.4.7.
 - Pinned goneat to `v0.5.13`.
 
 **Developer experience**

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.4.8
+0.4.9
diff --git a/docs/releases/v0.4.8.md b/docs/releases/v0.4.8.md
@@ -1,5 +1,5 @@
 ## Summary
-Maintenance release: refreshes the Go toolchain and dependencies, completes the GitHub Actions Node 20 → 24 migration, bumps the dogfooded goneat toolchain, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes, no API changes.
+Maintenance release: refreshes the Go toolchain and dependencies, retires archived Node12 release Actions in favor of softprops/action-gh-release@v2, bumps the dogfooded goneat toolchain, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes, no API changes.
 
 ## Highlights
 
@@ -8,7 +8,7 @@ Maintenance release: refreshes the Go toolchain and dependencies, completes the
 - Updated `golang.org/x/crypto` (v0.53.0), `golang.org/x/text` (v0.38.0), `golang.org/x/sys` (v0.46.0), `github.com/dlclark/regexp2` (v1.12.0), and `github.com/jedisct1/go-minisign` (latest commit). `govulncheck ./...` reports no vulnerabilities.
 
 ### CI / release
-- Replaced the archived, Node12-era `actions/create-release@v1` and `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 24), completing the Node 20 → 24 runner transition begun in v0.4.7 (which had already moved `checkout`/`setup-go`).
+- Replaced the archived, Node12-era `actions/create-release@v1` and `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 20). Checkout and setup-go had already moved to Node 24-era majors in v0.4.7.
 - Pinned the dogfooded goneat toolchain to `v0.5.13` (was `v0.5.10`) across the `Makefile` and CI install steps.
 
 ### Developer experience

diff --git a/docs/releases/v0.4.9.md b/docs/releases/v0.4.9.md
@@ -0,0 +1,37 @@
+## Summary
+Maintenance release: patches the Go toolchain and selected dependencies, adds a pinned vulnerability gate, hardens the self-bootstrap trust anchor, and moves release publish onto Node 24. No user-facing feature or API changes.
+
+## Highlights
+
+### Toolchain & supply chain
+- `go.mod` now pins `go 1.25.12` with `toolchain go1.26.5`; CI and the release workflow build with Go `1.26.5`. Released binaries ship with the patched 1.26.5 standard library while the module still builds on Go 1.25.x, clearing reachable stdlib advisories (including GO-2026-5856) inside Go's supported-major window.
+- Updated `golang.org/x/crypto` (v0.54.0), `golang.org/x/sys` (v0.47.0), and `golang.org/x/text` (v0.40.0). Pinned `govulncheck@v1.6.0` reports no reachable vulnerabilities.
+- Direct product dependencies (`go-minisign`, `jsonschema/v6` v6.0.2, `regexp2`) are unchanged.
+
+### CI / release
+- Bumped both `softprops/action-gh-release` steps from `@v2` (Node 20) to `@v3` (Node 24).
+- Pinned the dogfooded goneat toolchain to `v0.5.15` (was `v0.5.13`) across the `Makefile` and all CI install steps; install path uses sfetch with minisign verification.
+
+### Bootstrap & quality gates
+- Self-bootstrap (`make bootstrap`) now passes the installer `--dir` flag (was incorrect `--dest`), pins the binary with `--tag` matching `SFETCH_VERSION` (N-1: `v0.4.8`), and requires minisign verification so the downloaded script and installed binary are the same reviewed release.
+- Removed the unpinned external schema CLI from precommit. Corpus manifest validation runs in-repo via the product's `jsonschema/v6` v6.0.2 dependency.
+- `make precommit` (and CI Quality) runs pinned `govulncheck@v1.6.0`.
+
+## Validation
+- `make precommit` green (including govulncheck, gosec-high, five-platform build-all)
+- `go test ./...` green under Go 1.26.5
+- `GOTOOLCHAIN=go1.25.12 go test ./...` green (minimum supported line)
+- `govulncheck@v1.6.0 ./...` reports no reachable vulnerabilities
+- Corpus schema/manifest in-repo validation green
+
+## Install
+
+```bash
+curl -sSfL https://github.com/3leaps/sfetch/releases/latest/download/install-sfetch.sh | bash
+```
+
+Or self-update:
+
+```bash
+sfetch --self-update --yes
+```
diff --git a/go.mod b/go.mod
@@ -1,8 +1,8 @@
 module github.com/3leaps/sfetch
 
-go 1.25.5
+go 1.25.12
 
-toolchain go1.26.4
+toolchain go1.26.5
 
 require (
 	github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22
@@ -11,7 +11,7 @@ require (
 
 require (
 	github.com/dlclark/regexp2 v1.12.0 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 )
diff --git a/go.sum b/go.sum
@@ -4,9 +4,9 @@ github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22 h1:C68TAi+k12
 github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22/go.mod h1:vYVVh81Lqe/TP0sPLjiNYcX9Hxy/YSfkUx96lYJeyKo=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=