update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• go directive: 1.26.5 -> 1.26.6
• dependencies updated: 10
• vulnerabilities fixed: GO-2026-6179, GO-2026-6180
• gate green: precommit, check (exit 0)
• notes: Bumped Go 1.26.5→1.26.6, updated 10 direct deps including golang.org/x/mod v0.40.0 (fixes GO-2026-6179, GO-2026-6180); stdlib CVEs cleared by toolchain bump. All gates green.

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

Based on my analysis of the changed files (go.mod, go.sum, CHANGELOG.md) — all dependency files only, no Go source code — and the pre-computed mechanical funnel (0 findings), here is my review:

---

PR Review: update go module dependencies

Scope: go.mod, go.sum, CHANGELOG.md — dependency-only update, no source code changed.

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Selector mode traceability:

• Candidates: 0 judgment rules matched by Step 4b-i glob filter (no Go source files changed — dependency manifests only)
• Applicable: 0 rules
• Skipped: N/A — no candidate rules to evaluate against dependency manifests

Notes:

• golang.org/x/mod updated to v0.40.0 fixes security vulnerabilities GO-2026-6179 and GO-2026-6180 (confirmed by CHANGELOG and the version bump).
• Go directive correctly updated from 1.26.5 → 1.26.6.
• go.sum checksums correspond to updated module versions in go.mod.
• CHANGELOG entry is accurate and follows conventional format.
• precommit skipped (selector mode) — CI covers lint+test.

---

{
  "verdict": "approve",
  "summary": "Dependency-only update that correctly patches golang.org/x/mod to v0.40.0 (fixing GO-2026-6179 and GO-2026-6180) and updates the Go directive from 1.26.5 to 1.26.6. No source code changed; go.sum checksums are consistent with go.mod. CHANGELOG entry is accurate.",
  "comments": [],
  "concerns_addressed": [
    "security: golang.org/x/mod updated to v0.40.0 in go.mod:85 — fixes GO-2026-6179 and GO-2026-6180",
    "correctness: Go directive updated from 1.26.5 to 1.26.6 in go.mod:3",
    "correctness: go.sum checksums updated to match new module versions"
  ]
}