chore(deps): bump Go to 1.26.6

[lklimek]

TL;DR: Bumps the pinned Go toolchain from 1.26.5 to 1.26.6 across the repo (go.mod, CI workflows, Dockerfiles, docs) to clear six pre-existing Go standard-library vulnerability findings that govulncheck currently reports on v1.7-dev and on every open dependency-bump PR.

Detailed discussion

This is a pure internal/CI change with no user-observable behavior — no User story / Scenario sections.

Issue being fixed or feature implemented

govulncheck fails identically on v1.7-dev and on every open PR branch (#1412, #1411, #1410), independent of what each PR actually changes:

Fixed in: net/url@go1.26.6
Fixed in: html/template@go1.26.6
Fixed in: crypto/tls@go1.26.6
Fixed in: net/http@go1.26.6 (x2)
Fixed in: encoding/asn1@go1.26.6

All six are Go standard-library vulnerabilities (GO-2026-6218, 6091, 6090, 6089 x2, 5972), found at go1.26.5 and fixed at go1.26.6. None live in any third-party module, so no dependency bump can fix them. They're reachable from our TLS/RPC/HTTP server and Dash Core client paths — the same call sites documented in #1395, which fixed the previous instance of this exact pattern (1.26.4 → 1.26.5).

Confirmed via three independent dependency-review passes this session that the same six IDs, in the same order, are already present on a plain v1.7-dev push with no dependabot involvement — this is blocking unrelated PRs, not something any of them introduced.

What was done?

Bumped Go from 1.26.5 to 1.26.6 at every pin, mirroring #1395's file list exactly:

• go.mod
• DOCKER/Dockerfile, test/docker/Dockerfile, test/e2e/docker/Dockerfile
• go-version in the build, check-generated, e2e, govulncheck, lint, release and tests workflows, and .github/actions/bls/action.yml
• README.md, docs/tutorials/go.md, docs/tutorials/go-built-in.md, test/fuzz/README.md

Patch release only — no language or API changes.

How Has This Been Tested?

Locally, with the Go 1.26.6 toolchain:

go build ./...            # succeeds
govulncheck ./...          # 0 vulnerabilities (down from 6)

CI on this PR exercises the full build, lint, unit and e2e suites on the new toolchain — that's the authoritative signal for anything this local run couldn't reach.

Breaking Changes

None. Go patch release; no language or standard library API changes.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

Prior work

• chore: bump Go to 1.26.5 #1395 — the previous instance of this exact pattern (Go 1.26.4 → 1.26.5), same rationale and same file set.
• build(deps): Bump golang.org/x/net from 0.57.0 to 0.58.0 #1412, build(deps): Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 #1411, build(deps): Bump golang.org/x/crypto from 0.54.0 to 0.55.0 #1410 — open dependabot PRs currently blocked by this same pre-existing govulncheck failure; this PR unblocks all three.

Attribution

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: abd1f586-38dc-4da1-adcc-2687c9076192

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit 66fc928)

[thepastaclaw]

Final validation — Codex/Sol only (Phase 2 disabled)

The Go 1.26.6 toolchain bump is applied consistently across all 16 changed module, CI, Docker, and documentation files, with no stale Go 1.26.5 pins found. The exact head resolves successfully with Go 1.26.6, and the diff introduces no in-scope correctness issues. Source: Codex reviewer (exact backend model ID not supplied); Claude verifier (exact backend model ID not supplied); openclaw-agent/cliproxy/gpt-5.6-sol is orchestration-only and not reviewer evidence.

Validated zero-blocker Codex/Sol precheck evidence was promoted to final because Phase 2 (Sonnet/Opus) is temporarily disabled. This is Codex/Sol-only final validation, not Codex + Sonnet/Opus coverage.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet/Opus: not run (Phase 2 disabled — temporary Codex/Sol-only final)
• Secondary pass: disabled (temporary_phase2_sonnet_disable)