JGC-541 - Bump Go to 1.26.6 for CVE-2026-39821

[RemiBou]

Summary

• Bump Go toolchain from 1.26.5 to 1.26.6 to remediate CVE-2026-39821 (XRAY-988717), which blocked distribution of ecosystem-cli-docker-images-rb-v2-jf / 2.121.0.
• Updates go.mod and both Docker builder images (full + slim).

Context

JGC-541 tracks the Critical Xray violation on go://github.com/golang/go:1.26.3, 1.26.5, and 1.25.9. Go 1.26.6 is the patched release for the 1.26.x line.

Test plan

• CI build-gate passes
• Docker images build successfully with golang:1.26.6 base
• Next release RB scan clears CVE-2026-39821 on golang/go components

Made with Cursor

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

remib seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[github-actions]

View full scan results in JFrog Platform

---

🐸 JFrog Frogbot