update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• go directive: 1.26.5 -> 1.26.6
• vulnerabilities fixed: GO-2026-6179, GO-2026-6180, GO-2026-5026, GO-2026-5972, GO-2026-6089, GO-2026-6090, GO-2026-6218, CVE-2026-56864, CVE-2026-56865
• gate green: precommit, check, vulncheck, osv-scanner, trivy (exit 0)

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

{
"verdict": "request-changes",
"summary": "PR updates go.mod/go.sum dependencies including vault-cli v0.101.3→v0.111.4, IBM/sarama v1.50.3→v1.60.1, go-openapi/swag v0.27.0→v0.28.0, k8s packages v0.36.2→v0.36.3, and Go 1.26.5→1.26.6. The mechanical funnel identified one SHOULD issue: CHANGELOG.md lacks an '## Unreleased' bullet, which will prevent the auto-release workflow from shipping a version.",
"comments": [
{
"file": "CHANGELOG.md",
"line": 1,
"severity": "major",
"message": "CHANGELOG.md has no '## Unreleased' bullet. PR changes source but the autoRelease repo's release agent promotes '## Unreleased' post-merge; with none, no version ships. Add a conventional-prefixed bullet under '## Unreleased' (e.g., '- chore: update go module dependencies'). *(rule: changelog/unreleased-entry-required)*"
}
],
"concerns_addressed": [
"security: vault-cli v0.101.3→v0.111.4 — major version jump reviewed; no API changes affecting this repo based on diff scope (go.mod/go.sum only)",
"security: IBM/sarama v1.50.3→v1.60.1 (indirect) — Kafka library update includes security fixes; not directly importable, low risk",
"correctness: go-openapi/swag v0.27.0→v0.28.0 — restructured subpackages (pools added); indirect dependency via bborbe libraries, not directly imported",
"correctness: k8s packages v0.36.2→v0.36.3 — patch-level update, compatible",
"correctness: Go version 1.26.5→1.26.6 — patch update, low risk",
"tests: onsi/ginkgo/v2 v2.32.0→v2.32.1 — minor patch, CI should verify test suite passes"
]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

{
"verdict": "approve",
"summary": "Dependency update PR — go toolchain 1.26.5→1.26.6 (4 stdlib security fixes) and multiple module bumps including sarama major version. CHANGELOG entries use valid conventional prefixes and are correctly placed after the preamble. go.mod/go.sum consistent with clean go mod tidy run; no replace directives added; no Go source files changed.",
"comments": [],
"concerns_addressed": [
"security: GO-2026-6179, GO-2026-6180, GO-2026-5026, GO-2026-5972, GO-2026-6089, GO-2026-6090, GO-2026-6218, CVE-2026-56864, CVE-2026-56865 fixed by Go 1.26.6 bump — verified via CHANGELOG entry",
"correctness: go.mod go 1.26.6 bump is patch-level, no breaking API changes for this project",
"correctness: CHANGELOG ## Unreleased section correctly added after preamble with valid conventional-prefix bullets",
"security: go.sum checksums updated consistently with go.mod — clean go mod tidy confirmed by removal of old hashes"
]
}