[prgTW]

Problem

• Release binaries and the Docker image are built with Go 1.22, which no longer gets security fixes.
• Go 1.26.10 (CVE-2026-111943, https://go.dev/issue/82345) makes crypto/x509 reject TLS chains that contain eight compromised eMudhra intermediate CAs. Binaries built with older toolchains still accept them, so a certificate signed with one of those keys passes verification when s5cmd connects to an S3 endpoint.

Solution

• GoReleaser workflow: Go 1.22 → 1.26 for both the GCS test job and the release job.
• Dockerfile: golang:1.22-alpine → golang:1.26-alpine.
• CI: 1.26.x added to the build and test matrices. The go directive in go.mod stays at 1.20.
• 1.26.x is not added to the qa matrix. The vendored golang.org/x/tools used by make bootstrap does not compile on Go ≥ 1.23 (tokeninternal.go: invalid array length). The tooling update in Major dependency update and bugfix #878 would fix that.

Verification

• go vet and go test -mod=vendor ./... pass in golang:1.26.10-bookworm and in golang:1.22-bookworm.
• docker build . succeeds, and the resulting binary reports go1.26.10.