update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• go directive: 1.26.5 -> 1.26.6
• dependencies updated: 7
• vulnerabilities fixed: GO-2026-5026, GO-2026-5972, GO-2026-6090, GO-2026-6218
• gate green: precommit, check (exit 0)
• notes: Go 1.26.6 directive and Dockerfile bump; deps updated including golang.org/x/mod to v0.40.0 to resolve CVE-2026-56864 and CVE-2026-56865 found by trivy

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

PR Review Report: update go module dependencies

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

• CHANGELOG.md:6 — The ## Unreleased entry lacks a conventional prefix (chore:, fix:, etc.). The entry reads "update Go to 1.26.6 and update dependencies; fix GO-2026-5026..." but should be prefixed to enable correct semver bump detection, e.g. chore: update Go to 1.26.6 and dependencies or fix: update Go to 1.26.6 and dependencies. (rule: changelog/conventional-prefix-required)

Selector Mode Traceability

• Candidates: ~50 judgment rules evaluated (trigger globs matched no Go source files in this diff)
• Applicable: 1 rule (changelog/conventional-prefix-required)
• Skipped: All Go-specific rules (e.g. go-doc/*, go-architecture/*, go-error/*) → no .go files changed; all agent/command/skills rules → no agent/command/skill files changed; go-build-args/three-args-required → Dockerfile changed but no main.go or Makefile.docker present

Notes

• Security: The dependency updates (golang.org/x/mod, golang.org/x/net, golang.org/x/text, golang.org/x/tools) correctly address multiple CVEs (GO-2026-5026, GO-2026-5972, GO-2026-6090, GO-2026-6218, CVE-2026-56864, CVE-2026-56865) — this is a positive change.
• Go version consistency: go.mod (go 1.26.6) and Dockerfile (golang:1.26.6) are in sync — correct.
• No code impact: No Go source files were modified; only module metadata and Dockerfile. Precommit/lint skipped (selector mode) — CI covers it.

---

Next Steps: Rename the CHANGELOG.md entry to use chore: prefix before merging.

{
"verdict": "approve",
"summary": "Dependency update is clean and addresses multiple security advisories. Go directive and Dockerfile are in sync. One optional nit: the CHANGELOG.md unreleased entry lacks a conventional prefix which should be corrected for proper semver detection.",
"comments": [
{
"file": "CHANGELOG.md",
"line": 6,
"severity": "nit",
"message": "changelog/conventional-prefix-required: entry lacks a conventional prefix (chore:, fix:, etc.) — should be prefixed for correct semver bump detection"
}
],
"concerns_addressed": [
"security: dependency updates fix GO-2026-5026, GO-2026-5972, GO-2026-6090, GO-2026-6218, CVE-2026-56864, CVE-2026-56865 — addressed in go.mod/go.sum",
"correctness: go directive 1.26.5 -> 1.26.6 — addressed in go.mod",
"correctness: Go version bump in Dockerfile to 1.26.6 — addressed, matches go.mod"
]
}

[bborbe]

Superseded: master already has go 1.26.6. This branch was emitted from an older ref, a newer sibling PR merged first, and the branch now conflicts on the same go.mod/Dockerfile lines. Rebasing would yield an empty diff, so closing rather than fixing.