[fullstackjam]

What does this PR do?

Bump the minimum Go version from 1.26.9 to 1.26.10. All test, security-scan, and release workflows already read the toolchain version from go.mod, so no workflow changes are needed.

Why?

Fixes #175.

Go 1.26.9 is affected by GO-2026-6809, which adds distrust of compromised intermediate certificates in crypto/x509. The baseline scan reproduces the reachable path through updater.DownloadAndReplace; Go 1.26.10 resolves it.

Testing

• Reproduced GO-2026-6809 on the unchanged Go 1.26.9 baseline.
• govulncheck ./... passes on Linux and for Darwin arm64/amd64 with Go 1.26.10.
• Both Darwin release-style builds (CGO_ENABLED=0, -trimpath, -s -w) build and pass binary vulnerability scans. Build metadata confirms Go 1.26.10.
• go vet ./..., golangci-lint v2.11.4 run ./..., go build ./..., go mod verify, and go mod tidy -diff pass.
• All 24 internal packages pass race-enabled tests with exactly one test excluded: TestBackupConflicts_SkipsSocketFiles. The cloud sandbox blocks creation of its temporary Unix-domain socket; the unfiltered run is therefore not a full-suite pass.
• Native macOS L1/Homebrew integration, lint, L2 contract, smoke, and old-CLI compatibility passed in CI. The previously sandbox-blocked Unix-socket test passed on Darwin/arm64.
• The full L4 macOS VM E2E suite passed.
• All Harness checks, including the actual govulncheck step, passed.

CI verified head d1e3199c08bddb7560e6372ef99602b8a00405e7 via PR merge ref ccec8de7469ac3f2d3d0e88007bd09740a3ff587 against main 27859d1.

No application behavior or test code changed; this is a one-line toolchain security update.

Cross-repo checklist

• No docs/content update in openboot.dev is needed.
• No CLI/server API contract change; no openboot-contract update is needed.

Notes for reviewer

Only go.mod changes; dependencies and go.sum are unchanged. Existing released binaries need to be rebuilt and distributed to receive the fix. Please also check the informational govulncheck job, not only required checks.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T13:23:16.223427Z	d1e3199	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.