ken v1.1.1 — crypto/tls CVE fix + dependency updates

A patch release. It closes a reachable standard-library TLS vulnerability and folds in routine dependency updates. No API, wire-format, or default changes from 1.1.0 — a drop-in upgrade.

🔒 Security

• Toolchain go 1.26.4 → 1.26.5 fixes GO-2026-5856 — an Encrypted Client Hello privacy leak in the standard library's crypto/tls. ken's govulncheck CI gate (added in 1.1.0) flagged it as reachable, with real call paths through the MySQL introspection TLS handshake and the model-fetch HTTPS client. The fix is a single go-directive bump in go.mod, which propagates to every CI job (all read go-version-file: go.mod); govulncheck ./... now reports 0 affecting vulnerabilities. No source changes.

📦 Dependencies

No ken API changes; the full test suite and govulncheck are green on the combined tree.

• github.com/townsendmerino/aikit v1.5.0 → v1.9.0 — the extracted algorithm packages (BM25 / embed / ann / encoder / chunk / fuse / topk).
• modernc.org/sqlite v1.52.0 → v1.53.0 — pure-Go SQLite driver (Tier-2 DB indexing).
• github.com/odvcencio/gotreesitter v0.20.2 → v0.20.5 — pure-Go tree-sitter (treesitter chunker + Arm B enrichment).
• actions/checkout v6 → v7 (CI).

Install / upgrade

# Homebrew (macOS/Linux) — ken ships as a cask
brew upgrade --cask ken     # new install: brew install --cask townsendmerino/tap/ken

# Windows (Scoop)
scoop update ken            # new install: scoop bucket add townsendmerino https://github.com/townsendmerino/scoop-bucket; scoop install ken

# Or with Go
go install github.com/townsendmerino/ken/cmd/ken@v1.1.1
go install github.com/townsendmerino/ken/cmd/ken-mcp@v1.1.1

No config changes required. Upgrading is recommended for the TLS CVE fix if you use ken-mcp's remote-clone or MySQL Tier-2 introspection paths.

Full changelog: CHANGELOG.md · compare v1.1.0...v1.1.1