🤖 fix: bump Go to 1.26.9 and golang.org/x/net to v0.60.0

[ThomasK33]

Fixes #221

Summary

Bump the Go toolchain from 1.26.8 to 1.26.9 and golang.org/x/net from v0.58.0 to v0.60.0. This clears the 12 called vulnerabilities that make go tool govulncheck ./... (the last step of the required lint job) fail, and the HIGH findings that fail the Trivy filesystem and image scans.

Background

Since the vulnerability database update after 2026-10-03, every new CI run fails lint, Trivy filesystem scan and Trivy image scan, so no PR can merge (#163 included).

Advisories fixed (all were reported as called by coder-k8s code):

Advisory	CVE	Package	Summary
GO-2026-6599	CVE-2026-94448	stdlib	html/template: context tracking on consecutive template expressions
GO-2026-6600	CVE-2026-97030	stdlib	html/template: yield as regexp preceder keyword
GO-2026-6603	CVE-2026-78659	stdlib, x/net	HTTP/2 server memory exhaustion via Trailer headers
GO-2026-6605	CVE-2026-56866	stdlib	HTTP/1 client desync after CONNECT rejection
GO-2026-6607	CVE-2026-97031	stdlib	crypto/tls: malformed ECH outer extension references
GO-2026-6608	CVE-2026-94440	stdlib	net/textproto, mime/multipart: MIME header memory limit bypass
GO-2026-6609	CVE-2026-78667	stdlib	net/http: no limit on parsed Range header size
GO-2026-6610	CVE-2026-78660	stdlib, x/net	HTTP/2 transport accepts malformed framing headers
GO-2026-6611	CVE-2026-78669	stdlib, x/net	HTTP/2 CPU use from repeated initial window changes
GO-2026-6612	CVE-2026-78663	stdlib, x/net	HTTP/2 server double flow-control refund
GO-2026-6613	CVE-2026-94439	stdlib	HTTP/1 server desync after 2xx CONNECT response
GO-2026-6617	CVE-2026-97032	stdlib, x/net	HTTP/2 server crash from HPACK encoder race

Implementation

• go.mod: go 1.26.9. CI, CodeQL and release read the toolchain through setup-go go-version-file: go.mod, so no workflow change is needed. Dockerfile.goreleaser copies a prebuilt binary into distroless and pins no Go version. flake.nix uses the unpinned nixpkgs go and is not used by CI, so I left it and flake.lock unchanged.
• go get golang.org/x/net@v0.60.0, then go mod tidy && go mod vendor. Minimal version selection also raised the x/net requirements: x/crypto v0.57.0, x/mod v0.41.0, x/sync v0.23.0, x/sys v0.48.0, x/term v0.46.0, x/text v0.42.0. vendor/ is regenerated, not hand-edited.
• README badge, AGENTS.md and CONTRIBUTING.md now say 1.26.9.

Validation

• GOFLAGS=-mod=vendor go tool govulncheck ./... (the exact CI command, govulncheck v1.1.4 built and run with go1.26.9, DB updated 2026-10-08): before, 12 called vulnerabilities on go1.26.8 (the list above). After: Your code is affected by 0 vulnerabilities, exit 0. The one remaining module-level entry is GO-2026-5932 (unmaintained x/crypto/openpgp, not called, no fix exists).
• Trivy v0.74.0 (the CI version), HIGH/CRITICAL, exit code 1 on findings: fs --skip-dirs vendor on a git archive of the head reports 0 for go.mod. A CGO_ENABLED=0 go1.26.9 build of the binary reports 0 for the gobinary target.
• make verify-vendor, make build, make lint, make test, make test-integration, make docs-check pass locally. make vuln fails on my host only because its PATH govulncheck was built with go1.25 ("package requires newer Go version go1.26"); CI does not use that binary.

Risks

Low. This is a patch-level toolchain bump plus patch/minor bumps of golang.org/x modules. No coder-k8s code changes. The full Kind E2E in CI covers the runtime paths.

---

Generated with mux • Model: anthropic:claude-opus-5-5 • Thinking: high

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T16:08:45.287010Z	dda8efa	PR opened
🔒 Security Review	✅ Completed 2026-10-12T16:16:57.183980Z	dda8efa	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: dda8efaa80

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.