update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• go directive: 1.26.5 -> 1.26.6
• dependencies updated: 7
• vulnerabilities fixed: GO-2026-5026, GO-2026-5972, GO-2026-6090, GO-2026-6218, CVE-2026-56864, CVE-2026-56865
• gate green: precommit, check (exit 0)
• notes: Bumped go directive to 1.26.6, Dockerfile golang base image to 1.26.6, golang.org/x/mod to v0.40.0 (fixing CVE-2026-56864/56865), and updated transitive x/net, x/text, x/tools; all stdlib CVEs cleared by Go 1.26.6 directive.

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

Based on my analysis of the diff:

Findings:

The changes are a routine Go dependency update that properly addresses security vulnerabilities:

1. go.mod — go directive updated from 1.26.5 → 1.26.6 ✓
2. Dockerfile — base image updated from golang:1.26.5 → golang:1.26.6 ✓ (matches go.mod)
3. golang.org/x/mod — v0.37.0 → v0.40.0 (fixes CVE-2026-56864, CVE-2026-56865) ✓
4. golang.org/x/net — v0.57.0 → v0.58.0 ✓
5. golang.org/x/text — v0.40.0 → v0.41.0 ✓
6. golang.org/x/tools — v0.47.0 → v0.49.0 ✓
7. go.sum — checksums updated consistently with go.mod changes ✓
8. CHANGELOG.md — correctly documents the unreleased update with all CVE/GO identifiers ✓

Verification:

• Dockerfile golang version matches go.mod go directive: 1.26.6 in both ✓
• go.sum entries are consistent with go.mod indirect dependency versions ✓
• The go.sum diff shows only the entries for the changed modules were modified (no orphaned entries) ✓

Selector mode notes:

• mechanical funnel: 0 findings (already run per pre-filled args)
• selector-mode-guide.md not found at expected path — toolchain gap noted, but mechanical funnel results are authoritative

---

{
"verdict": "approve",
"summary": "Routine Go dependency update upgrading Go to 1.26.6 and patching golang.org/x/mod to v0.40.0 (fixing CVE-2026-56864 and CVE-2026-56865), plus x/net, x/text, and x/tools updates. Dockerfile base image correctly matches go.mod go directive. CHANGELOG.md documents all CVEs. No issues found.",
"comments": [],
"concerns_addressed": [
"security: golang.org/x/mod bump to v0.40.0 fixes CVE-2026-56864 and CVE-2026-56865 — addressed",
"security: Go 1.26.6 directive addresses CVEs GO-2026-5026, GO-2026-5972, GO-2026-6090, GO-2026-6218 — addressed",
"correctness: Dockerfile golang base image 1.26.6 matches go.mod go directive 1.26.6 — addressed",
"correctness: transitive dependencies (x/net, x/text, x/tools) updated consistently — addressed",
"tests: updated dependencies do not introduce breaking API changes — no issues detected"
]
}