chore: bump Go to 1.26.10

Merged
TH
5d ago
+1-1

Why

The private keys of eight eMudhra (emSign) intermediate CA certificates were reported compromised (incident summary, Mozilla). Go 1.26.10 and 1.27.3 block those intermediates' public keys in crypto/x509, so certificate chains through them no longer verify.

Every release and CI workflow installs Go from go.mod, so this bump puts the block into released CLI binaries.

What changed

  • go.mod: go 1.26.8 → go 1.26.10. No other Go version pins exist in the repository.

Testing

With Go 1.26.10: go build ./... and go vet ./... pass; go mod tidy makes no changes.

Summary by cubic

Bumps Go from 1.26.8 to 1.26.10 in go.mod — the only Go version pin in the repo — to pull in the crypto/x509 block on the compromised eMudhra/emSign intermediate CA keys. Since builds resolve the Go version from go.mod, the block applies to released CLI binaries.

Testing

  • go build ./..., go vet ./..., and go mod tidy all pass with 1.26.10.