Upgrade Go to 1.26 to fix 3 CVEs [release-1.8]

[midays]

Summary

• Upgrades Go from 1.25.0 to 1.26 to fix 3 CVEs

CVEs Fixed

• MIG-2019: CVE-2026-48050 - Arc: Information disclosure and DoS via unauthenticated debug endpoints
• MIG-1987: CVE-2026-56858 - Go html/template: Cross-Site Scripting via pathological input
• MIG-1980: CVE-2026-41178 - OpenTelemetry-Go: DoS via oversized baggage headers

Changes

• Updated go.mod: go 1.25.0 → go 1.26

Jira Tickets

• https://redhat.atlassian.net/browse/MIG-2019
• https://redhat.atlassian.net/browse/MIG-1987
• https://redhat.atlassian.net/browse/MIG-1980

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 274de1c9-b745-4ab6-8f69-410017cae123

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[midays]

Closing - fix was incorrect. Need to properly verify CVE applicability and fix versions.