update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• go directive: 1.26.5 -> 1.26.6
• dependencies updated: 20
• vulnerabilities fixed: GO-2026-6179, GO-2026-6180, GO-2026-5026, GO-2026-5972, GO-2026-6089, GO-2026-6090, GO-2026-6218, CVE-2026-56864, CVE-2026-56865
• gate green: precommit, check, vulncheck, osv-scanner, trivy (exit 0)
• notes: bumped Go 1.26.5->1.26.6 in go.mod (already correct) and Dockerfile, all deps upgraded via prior go get -u, golang.org/x/mod@v0.40.0 clears all vuln findings, all 5 gate targets green

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

Now I have all the information needed for the adjudication. Let me compile the findings:

Step 4c-sel CLASSIFY:

• changelog/conventional-prefix-required → Applicable (CHANGELOG.md changed)
• go-build-args/three-args-required → Applicable (Dockerfile changed)
• go-mod-dependency-fix/tidy-after-get-update → Applicable (go.mod/go.sum changed)
• go-licensing/copyright-year-discipline → Skipped (no .go files changed)
• go-mod-dependency-fix/exclude-over-cross-repo-replace → Skipped (no replace directives in diff)
• All @commits-triggered rules → Skipped (no commits in diff scope)
• All Go file rules → Skipped (no .go files changed)

Step 4d-sel ADJUDICATE:

1. CHANGELOG.md: The ## Unreleased bullet uses chore: — valid conventional prefix. No violation.
2. Dockerfile: Missing BUILD_GIT_VERSION build arg — only BUILD_GIT_COMMIT and BUILD_DATE are present. The rule requires all three canonical args.
3. go.mod/go.sum: The go.mod tidy side-effect is present (go.sum has bidirectional hash entries, no orphaned hashes). No violation.

---

PR Review: update go module dependencies

Must Fix (Critical)

None.

Should Fix (Important)

• Dockerfile:1-23 — Missing BUILD_GIT_VERSION build arg. The go-build-args/three-args-required rule requires all three canonical build arguments: BUILD_GIT_VERSION, BUILD_GIT_COMMIT, and BUILD_DATE. The Dockerfile only declares BUILD_GIT_COMMIT and BUILD_DATE. The BUILD_GIT_VERSION arg (typically git describe --tags --always --dirty) should be added alongside the existing two. (rule: go-build-args/three-args-required)

Nice to Have (Optional)

• go.mod:3 — Go version updated from 1.26.5 to 1.26.6; no issues noted. The update clears multiple stdlib advisories (GO-2026-6179, GO-2026-6180, GO-2026-5026, GO-2026-5972, GO-2026-6089, GO-2026-6090, GO-2026-6218) and golang.org/x/mod@v0.40.0 clears CVEs CVE-2026-56864 and CVE-2026-56865. Clean update.

Notes: The go.sum diff shows proper go mod tidy hygiene (bidirectional hash entries, no orphaned hashes). The github.com/google/go-github/v88 indirect addition is an expected transitive of updated dependencies. The golang.org/x/mod bump from v0.37.0 → v0.40.0 is the key security fix.

---

Traceability:

• Candidates: 6 judgment rules matched by Step 4b-i glob filter
• Applicable: 3 rules selected by Step 4c-sel
• Skipped: go-licensing/copyright-year-discipline → no .go files changed; go-mod-dependency-fix/exclude-over-cross-repo-replace → no replace directives in diff; @commits-triggered rules → no commits in diff scope; all **/*.go-triggered rules → no .go files changed

---

{
"verdict": "request-changes",
"summary": "Dependency update is clean and resolves multiple security advisories. One Should Fix: Dockerfile is missing the BUILD_GIT_VERSION build arg required by the go-build-args/three-args-required rule.",
"comments": [
{
"file": "Dockerfile",
"line": 1,
"severity": "major",
"message": "Missing BUILD_GIT_VERSION build arg. The three-args-required rule requires BUILD_GIT_VERSION, BUILD_GIT_COMMIT, and BUILD_DATE — only the latter two are declared. Add 'ARG BUILD_GIT_VERSION=none' alongside lines 3-4."
}
],
"concerns_addressed": [
"security: vulnerabilities cleared via golang.org/x/mod@v0.40.0 and Go 1.26.6 directive bump",
"correctness: Dockerfile Go version 1.26.6 matches go.mod directive",
"correctness: go.mod tidy present — no orphaned go.sum entries",
"tests: gate checks passed (precommit, check, vulncheck, osv-scanner, trivy)"
]
}

[bborbe]

Superseded: master already has go 1.26.6. This branch was emitted from an older ref, a newer sibling PR merged first, and the branch now conflicts on the same go.mod/Dockerfile lines. Rebasing would yield an empty diff, so closing rather than fixing.