[ekalinin]

What changed

Every workflow pin moves from Go 1.26.6 to 1.26.9 - the test matrix, the module-verification job, the govulncheck action input, the release build, and the e2e job. The existing Security entry in CHANGELOG.md is updated to the new version and lists the new vulnerabilities.

Why

The vulnerability job fails on master (run 38302841781). govulncheck reports nine standard-library vulnerabilities in 1.26.6 as reachable from this code:

ID	Package	Reached via
GO-2026-6617	net/http	adapters.doHTTPReq -> http.Client.Do
GO-2026-6613	net/http	adapters.Notifier.Notify -> http.CanonicalHeaderKey
GO-2026-6612	net/http	adapters.doHTTPReq -> http.Client.Do
GO-2026-6611	net/http	adapters.doHTTPReq -> http.Client.Do
GO-2026-6610	net/http	adapters.doHTTPReq -> http.Client.Do
GO-2026-6608	net/textproto, mime/multipart	controller.ProcessSTDIN -> textproto.Reader.ReadMIMEHeader
GO-2026-6607	crypto/tls	adapters.doHTTPReq -> tls.Conn.HandshakeContext
GO-2026-6605	net/http	adapters.doHTTPReq -> http.Client.Do
GO-2026-6603	net/http	adapters.doHTTPReq -> http.Client.Do

All nine are fixed in 1.26.9. No code changed - the vulnerability database did, so the job fails on every branch.

Compatibility

CI and release toolchain only. go.mod still declares go 1.26.

Validation

GOTOOLCHAIN=go1.26.6 govulncheck ./...
Your code is affected by 9 vulnerabilities from the Go standard library.

GOTOOLCHAIN=go1.26.9 govulncheck ./...
No vulnerabilities found.

GOTOOLCHAIN=go1.26.9 go vet ./...
GOTOOLCHAIN=go1.26.9 go test -race ./...

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.34%. Comparing base (a4b3496) to head (28a7c54).

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #93   +/-   ##
=======================================
  Coverage   82.34%   82.34%           
=======================================
  Files          37       37           
  Lines        1184     1184           
=======================================
  Hits          975      975           
  Misses        132      132           
  Partials       77       77           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.