v1.9.4

Security

• Pin Go toolchain to 1.25.11 (#34) — govulncheck flagged 19 reachable Go standard library vulnerabilities (crypto/tls, crypto/x509, net/http, net/url, net/textproto, encoding/asn1) when building with go1.24.4. The toolchain directive in go.mod now pins go1.25.11, which patches all of them. The go 1.21 language minimum is unchanged, so consumers on Go ≥ 1.21 are unaffected; builds of this module now use a patched toolchain. govulncheck reports no vulnerabilities in either the main or integration-test module.

Fixes

• Publish-recovery hardening (#31) — bounded polling, content-based carousel matching, and a root-post discriminator when recovering from /threads_publish HTTP 5xx and code-10 false failures; context errors are now propagated during recovery.

CI

• Bump actions/checkout to v7 and codecov/codecov-action to v7 (covers dependabot #33, #32).

Full changelog: v1.9.3...v1.9.4