update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• go directive: 1.26.5 -> 1.26.6
• dependencies updated: 14
• vulnerabilities fixed: GO-2026-6179, GO-2026-6180
• gate green: precommit, check, vulncheck (exit 0)
• notes: Bumped go directive to 1.26.6, updated 13 dependencies including golang.org/x/mod to v0.40.0 to fix GO-2026-6179 and GO-2026-6180

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

PR Review: update go module dependencies

Summary

This PR updates Go module dependencies, including a security fix for golang.org/x/mod (GO-2026-6179 and GO-2026-6180). The go directive was updated from 1.26.5 to 1.26.6 (patch update, appropriate). No source code changed — only dependency declarations.

Changed Files

File	Change
go.mod	go 1.26.5 → 1.26.6, module updates
go.sum	Updated hashes for all modules
CHANGELOG.md	Added unreleased entry

Security Update

• golang.org/x/mod v0.39.0 → v0.40.0 — addresses GO-2026-6179 and GO-2026-6180 vulnerabilities ✅

Dependency Health

All updated modules are patch/minor updates from the same github.com/bborbe/* families:

• kv v1.21.7 → v1.21.9
• log v1.6.19 → v1.6.22
• math v1.3.17 → v1.3.18
• run v1.9.32 → v1.9.34
• time v1.27.7 → v1.27.8
• collection v1.20.19 → v1.20.20
• parse v1.10.18 → v1.10.19
• validation v1.4.18 → v1.4.19

No major version bumps, no removed dependencies.

CHANGELOG Quality

The unreleased entry "update Go to 1.26.6 and update dependencies" appropriately signals both the toolchain and dependency scope.

---

{
  "verdict": "approve",
  "summary": "Clean dependency update including critical security fix for golang.org/x/mod (GO-2026-6179/GO-2026-6180). Go toolchain updated from 1.26.5 to 1.26.6 (patch). All module updates are minor/patch from stable families. CHANGELOG updated appropriately.",
  "comments": [],
  "concerns_addressed": [
    "security: golang.org/x/mod updated from v0.39.0 to v0.40.0 to fix GO-2026-6179 and GO-2026-6180 vulnerabilities — addressed",
    "correctness: go directive updated from 1.26.5 to 1.26.6 — addressed, appropriate patch update within same minor version"
  ]
}