fold: Skill for Claude Code

Dependencies and vulnerabilities

fold has 13 direct dependencies and runs at a trust boundary, so the supply chain is part of the threat model rather than housekeeping. Four separate mechanisms watch it, and knowing which one is talking saves the whole investigation.

A red govulncheck often has no commit behind it

Check this first, before reading the diff. make vuln runs go tool govulncheck (pinned in go.mod as a tool dependency, bumped by Dependabot) against the live advisory database, so a run that was green yesterday goes red today because an advisory was published — not because anything changed here.

go version                          # the toolchain in use
grep '^go ' go.mod                  # the version this module requires
make vuln                           # read WHICH module and WHICH advisory

If the finding is in the standard library, the fix is a Go patch version, not a dependency bump: raise the go line in go.mod and let the toolchain download it. That has happened here before — six standard-library advisories at once, fixed by moving to a Go patch release.

If the finding is in a dependency, bump that dependency alone. Do not run a blanket go get -u; a vulnerability fix and a feature bump should not arrive in one commit.

Either way the image builder base may also need repinning — it sets GOTOOLCHAIN=local, so an image whose base is below what go.mod requires cannot fix it at build time and fails the build. That skew once sat on main through two green merges and failed after the tag was pushed. CI's image job now catches it per-PR; check deploy/docker/*.Dockerfile when you move the Go line.