The version pin you can't lower
A standard-library security fix forced a Go version bump, and then the release failed because the build image shipped an older toolchain.

A standard-library security fix forced a Go version bump, and then the release failed because the build image shipped an older toolchain.

Moving off tag-on-merge releases, where a release is a side effect of merging, to a model where the release is itself a reviewable change.

A CI component gated on the default branch fired on every Renovate schedule too, because a scheduled run is also on the default branch.
