update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• go directive: 1.26.5 -> 1.26.6
• dependencies updated: 7
• vulnerabilities fixed: GO-2026-5972, GO-2026-6090, CVE-2026-56864, CVE-2026-56865
• gate green: precommit, check (exit 0)
• notes: Bumped Go 1.26.5→1.26.6; upgraded golang.org/x/mod→v0.40.0 (fixes CVE-2026-56864/565), x/net→v0.58.0, x/tools→v0.49.0; updated bborbe/* deps; all gates green

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

Based on my analysis:

Step 0: Already at PR head (HEAD == origin/fix/update-go-acf86e8 == 6481760), no worktree needed.

Step 1: Selector mode (default).

Step 2: Go project (go.mod exists).

Step 3a: LICENSE file exists ✓

Step 3b: precommit skipped (selector mode) — CI covers lint+test.

Step 4: The changed files are exclusively CHANGELOG.md, go.mod, and go.sum — pure dependency manifest updates with no source code changes. The ast-grep mechanical funnel returned 0 findings across 74 YAMLs. There are no Go/Python/Node source files in the diff, so no judgment rules apply (Step 4 early-exit condition met: no rule-relevant files changed).

Step 5 — Consolidated Report:

---

PR Review: update go module dependencies

Branch: fix/update-go-acf86e8 → master
Files changed: CHANGELOG.md, go.mod, go.sum (3 files, +29/−25 lines)

---

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Selector Mode Traceability:

• Candidates: 0 rules matched by Step 4b-i glob filter (no source code files in diff)
• Applicable: 0 rules
• Mechanical funnel: 0 findings (74 YAMLs scanned)
• Note: Diff contains only dependency manifest files — no Go/Python/JS sources, no handlers, no tests, no YAML k8s resources. No rule's trigger glob matches go.mod/go.sum/CHANGELOG.md.

---

Notes:

• The dependency updates (golang.org/x/mod v0.38.0→v0.40.0, golang.org/x/net v0.57.0→v0.58.0, golang.org/x/tools v0.48.0→v0.49.0) are all backward-compatible minor/patch bumps. The golang.org/x/mod update addresses CVE-2026-56864/CVE-2026-56865 as documented in the CHANGELOG. The go directive moved from 1.26.5 to 1.26.6 (patch release). The github.com/bborbe/* indirect dependencies are all patch/minor bumps.
• precommit skipped (selector mode) — CI covers lint+test.
• selector clean — no adjudication needed

---

{
  "verdict": "approve",
  "summary": "Pure dependency update (go.mod/go.sum/go.sum) with no source code changes. All bumps are backward-compatible patches/minors including golang.org/x/mod v0.40.0 which addresses CVE-2026-56864/CVE-2026-56865. CHANGELOG.md properly documents the unreleased change.",
  "comments": [],
  "concerns_addressed": [
    "security: golang.org/x/mod upgraded to v0.40.0 (fixes CVE-2026-56864/CVE-2026-56865) — addressed in go.mod",
    "security: golang.org/x/net upgraded to v0.58.0 — addressed in go.mod",
    "security: golang.org/x/tools upgraded to v0.49.0 — addressed in go.mod",
    "correctness: go directive 1.26.5 → 1.26.6 (patch release, backward-compatible) — addressed in go.mod",
    "correctness: github.com/bborbe/* dependencies updated (v1.27.7→v1.27.8, v1.20.19→v1.20.20, etc.) — addressed in go.mod, all backward-compatible"
  ]
}