Release binaries are built with Go 1.25.7, which no longer receives security fixes #1222

Vale v3.26.0's release binaries are built with Go 1.25.7: go version -m on the macOS arm64 binary reports go1.25.7, and .github/workflows/main.yml pins go-version: "1.25.7" for GoReleaser (test.yml, commits.yml and golangci-lint.yml pin the same; go.mod declares go 1.25.7).

Go 1.25 left support when Go 1.27 was released; its last patch is 1.25.14. Source-mode govulncheck v1.9.0 of ./cmd/vale at v3.26.0 under Go 1.25.7 reports 53 advisories, 32 with a vulnerable function reachable from main (darwin/arm64):

• 15 stdlib, fixed in Go 1.25.8 to 1.25.13;
• 10 stdlib fixed only in Go 1.26.9 or 1.26.10, e.g. GO-2026-6612 (net/http);
• 2 in golang.org/x/net v0.57.0 (GO-2026-6860, GO-2026-6866), fixed in v0.62.0;
• 5 in github.com/tomwright/dasel, with no fixed version.

Would you consider building releases with a supported Go (e.g. 1.26.10 or 1.27.3, or go-version: stable with check-latest: true) and moving golang.org/x/net to v0.62.0? A patch release built that way would let downstream users pick up the fixes.