fix(deps): move to Go 1.26.6 for six stdlib advisories

[JonJagger]

Snyk's dependency test fails on six high and medium stdlib advisories, all
of them fixed on this line in 1.26.6: crypto/tls (CVE-2026-56862), net/http
(CVE-2026-56853), net (CVE-2026-46600), encoding/asn1 (CVE-2026-33818),
encoding/xml (CVE-2026-56859) and html/template (CVE-2026-56858). std/net is
the one that decides the target: it has no fix on the 1.25 line.

Only go.mod names a patch level. .go-version and the Dockerfile track the
1.26 line, every workflow reads .go-version, and the Dockerfile already sets
GOTOOLCHAIN=auto, so the directive is what pulls the newer toolchain in.

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed

[claude]

Claude finished @JonJagger's task in 4m 11s —— View job

---

Review: PR #1102 — Go 1.26.6 bump

• Read PR diff and Go version files
• Static analysis (go build, go vet, go mod tidy)
• Verify PR claims (workflows read .go-version, Dockerfile GOTOOLCHAIN=auto)
• Post review

---

Verdict: LGTM ✅ — a clean, minimal, correctly-scoped dependency bump. Approve-worthy (I can't formally approve, but I have no concerns).

Static analysis

Check	Result
go build ./...	✅ pass (exit 0)
go vet ./...	✅ pass (no findings)
go mod tidy + git diff --exit-code go.mod go.sum	✅ clean (no missing/unused deps)

Claims verified

The PR body's reasoning holds up against the tree:

• go.mod is the only file naming a patch level — confirmed; the diff is a single line go 1.26.5 → go 1.26.6.
• .go-version tracks the 1.26 line — confirmed (.go-version = 1.26, no patch).
• Workflows read .go-version — confirmed via go-version-file: '.go-version' in test.yml (lines 87, 134) and release.yml (line 158).
• Dockerfile tracks the 1.26 line with GOTOOLCHAIN=auto — confirmed (ARG GO_VERSION="1.26", ENV GOTOOLCHAIN=auto).

So the go directive is indeed what pulls the newer toolchain: setup-go/the Docker golang:1.26 image provision the 1.26 line, and GOTOOLCHAIN=auto upgrades to ≥1.26.6 to satisfy the directive. This means the six stdlib advisories get patched without touching any workflow or the Dockerfile. Nicely surgical.

Notes

• Testability/tests: N/A — a toolchain directive bump has no behavioural surface to test; the CI build/test run is the right gate.
• Security: this is the security fix (six CVEs across crypto/tls, net/http, net, encoding/asn1, encoding/xml, html/template). No new surface introduced.
• Minor, non-blocking: because .go-version only pins the minor (1.26), the floor is enforced by the go.mod directive rather than by an exact pin. That's a deliberate and reasonable choice here (lets patch pickups happen automatically), just worth being aware of — a runner with a stale local toolchain and GOTOOLCHAIN overridden to something other than auto could theoretically build with an older patch, but the committed config makes that a non-issue.

Good work

Clear, well-researched PR description that pinpoints exactly why 1.26.6 (the net fix has no 1.25 backport) and confirms the blast radius before making a one-line change. That's the right amount of diligence for a dependency bump.
· branch go-1.26.6