[dimoschi]

• govulncheck on master reported 10 reachable vulnerabilities in the Go 1.26.8 standard library: GO-2026-6809 (crypto/x509, fixed in 1.26.10), GO-2026-6617, 6613, 6612, 6611, 6610, 6608, 6607, 6605, 6603 (net/http, crypto/tls, mime/multipart, fixed in 1.26.9). Five of them (6617, 6612, 6611, 6610, 6603) also affect golang.org/x/net v0.57.0, fixed in v0.60.0.
• Go 1.26.8 -> 1.26.10 in the go directive, mise.toml and the Dockerfile builder stage. CI and the release job use go-version-file: go.mod, so the go directive is what puts the fixed stdlib into the released binaries.
• golang.org/x/net v0.57.0 -> v0.60.0. This pulls x/sys v0.48.0, x/term v0.46.0 and x/text v0.42.0.
• Overlaps fix(deps): bump the docker group across 1 directory with 2 updates #30 (Dependabot docker group): it moves the builder to golang:1.27.0-alpine and alpine to 3.24.2. This PR only takes the 1.26 patch release and leaves alpine alone. Close or rebase fix(deps): bump the docker group across 1 directory with 2 updates #30 after this lands. fix(deps): bump the kubernetes group with 3 updates #31 (k8s 0.37.1) does not touch x/net.

Checks run locally with Go 1.26.10:

• go build ./...: exit 0
• go vet ./...: exit 0
• go test ./...: exit 0
• golangci-lint run ./... (v2.12.2, the CI pin): exit 1 with the same 4 revive findings as master (unused t params in tests). CI runs it with only-new-issues.
• govulncheck ./...: exit 0, no vulnerabilities found.

Not verified: Docker image build, goreleaser build, e2e bats suite.

[Copilot]

🟢 Approval recommended

No unresolved review comments were identified, and all approval-readiness assessments support approval.

No open issues 🎉

What changed in this PR

Updates the Go toolchain and networking dependencies to versions containing security fixes, while keeping local development, module metadata, and the production Docker build aligned.

Changes:

• Upgrades Go from 1.26.8 to 1.26.10 in go.mod, mise.toml, and the Docker builder image.
• Upgrades golang.org/x/net to v0.60.0 and refreshes related x/sys, x/term, and x/text dependencies.
• Refreshes go.sum checksums for the updated modules.

File	Description
mise.toml	Pins local development to Go 1.26.10.
go.sum	Records checksums for the updated modules.
go.mod	Updates the Go directive and dependency versions.
Dockerfile	Uses the Go 1.26.10 Alpine builder image.

_{Review effort: Lite}