fix: require Go 1.26.6 to resolve GO-2026-5026-stdlib
Summary
Updated the module's required Go version from 1.26.5 to 1.26.6 so builds pick up the patched standard library release for the IDNA hostname validation flaw.
Vulnerability Fixed
GO-2026-5026-stdlib (HIGH): the Go standard library incorrectly accepted malformed Punycode labels that normalize to ASCII-only hostnames, which can enable hostname-based authorization bypasses in affected programs.
Changes Made
- Updated
go.modfromgo 1.26.5togo 1.26.6to require the patched Go toolchain/stdlib release identified by the assessment. - Kept the remediation limited to the module manifest so downstream builds resolve the fixed toolchain version without unrelated source changes.
Verification
Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository checkout. Outcome: unable-to-verify.
grype completed successfully, but GO-2026-5026-stdlib was not reported in the repository SBOM before or after the manifest bump, so this source scan could not directly prove removal of the stdlib advisory. The fix remains the manifest update to require Go 1.26.6.