v2.3.1

This tag carries no change to the binary. No non-test Go file differs from v2.3.0, and upgrading changes the reported version string and nothing else. It exists for two things the v2.3.0 tag does not hold.

• docs/profile-dsl-reference.md is in a release tree. The page was written before v2.3.0, but scripts/public-release-manifest.json did not list it, so the v2.3.0 tag carries no copy and git checkout v2.3.0 produces none. gumcli.dev serves main and had published the page the whole time, which is why nothing caught it.
• scripts/check-govulncheck.py replaces govulncheck ./... as the gate in the pull-request workflow and the release workflow. govulncheck exits 0 when an advisory covers only import paths the build never compiles, so such an advisory used to reach main without failing any gate. GO-2026-5932 arrived that way.
• scripts/govulncheck-allowlist.json is the only way to accept one, and each entry names the advisory id, the module, the reason the requirement stays and the date. A finding the build can reach has no allowlist path at all. A recorded advisory the scan no longer reports also fails, so the file cannot rot. make vulncheck runs the same gate from a checkout.

No vulnerability fix and no dependency change. The gate reports 0 findings the build can reach and one module-level finding, GO-2026-5932 in golang.org/x/crypto, which the allowlist records. That advisory names no fixed version: its affected range opens at 0 and carries no fixed event, because the finding is that golang.org/x/crypto/openpgp is unmaintained rather than a defect a release repairs. gum imports none of the seven affected packages, and the module stays in the graph for golang.org/x/crypto/cryptobyte, which github.com/google/s2a-go reaches under cloud.google.com/go/auth, so the requirement cannot be dropped either.

All seven release jobs passed, and the govulncheck job is the first to run the new gate on CI against a scanner installed by the pinned go install. git checkout v2.3.1 produces docs/profile-dsl-reference.md, hashing to 235b8b5089245378c38ebef0cbf054130a96e1edb6b5f465f6a58da7bf6f3bc9, the same digest as the source tree. The four downloaded archives matched checksums.txt, and their digests matched the in-toto provenance subjects; that statement names commit f8ef8dad227fc1c57925ca02c0d90e60aec0d488 and refs/tags/v2.3.1. The binary extracted from each archive matched its entry in release-binaries.sha256. A local go1.26.7 rebuild from a clean clone at this tag reproduced all four published binaries byte for byte. gumcli.dev serves the release notes and the changelog byte-identical to the docs built from this tag. brew audit --strict --online and brew test both passed, tap-drift confirms both formulae point at this release, and the installed libexec/gum hashes to the published darwin_arm64 binary.

brew update
brew upgrade ehmo/tap/gum
gum --version

Release notes · Changelog · Release verification