fix(ci): bump Go to 1.26.9 and patch vulnerable modules

[ndbroadbent]

CI's lint job has failed at the govulncheck step on every main push since 2026-09-10. It reported 15 vulnerabilities reachable from our code:

• Go 1.26.4 standard library: net/http, crypto/tls, html/template, net/url, encoding/xml, encoding/asn1, os
• golang.org/x/text
• google.golang.org/grpc
• moby/go-archive
• aws-sdk-go-v2 s3/eventstream

Changes:

• Go 1.26.4 → 1.26.9 in go.mod, mise.toml, the three Dockerfiles, and the ci/e2e/release workflows
• x/text 0.42.0, x/net 0.60.0, grpc 1.84.0, moby/go-archive 0.3.3, service/s3 1.114.2, otel sdk 1.47.0, plus transitive bumps from go mod tidy

Verified locally:

• task go:sec:vuln reports 0 vulnerabilities
• task go:lint: 0 issues
• task go:sec:secrets: clean
• task go:test: 694 unit tests and 18 integration tests pass

The E2E workflow will exercise the new Docker base image.

Summary by CodeRabbit

• Chores
  • Updated the Go version used for builds, tests, linting, and end-to-end checks to 1.26.9.
  • Updated Go module dependencies.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: c892f575-d614-4fd7-b831-e40bd975e4c1

📥 Commits

Reviewing files that changed from the base of the PR and between 31654ad and 4c4ff0b.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• .github/workflows/e2e.yml
• .github/workflows/release.yml
• Dockerfile
• Dockerfile.gateway-dev
• Dockerfile.mock-convox
• go.mod
• mise.toml

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

Walkthrough

The Go version changes from 1.26.4 to 1.26.9 in module metadata, local tooling, CI workflows, and Docker builder images. The pull request also updates, adds, and removes Go module dependencies.

Changes

Go Toolchain Update

Layer / File(s)	Summary
Module and local toolchain go.mod, mise.toml	The Go version changes to 1.26.9. Direct and indirect dependencies are added, upgraded, or removed.
CI and container build versions .github/workflows/ci.yml, .github/workflows/e2e.yml, .github/workflows/release.yml, Dockerfile, Dockerfile.gateway-dev, Dockerfile.mock-convox	CI jobs and Docker builder images use Go 1.26.9.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4c4ff

The Go 1.26.9 versions align across the module, CI, and builder images. The cited SPDY code is not called by the CLI flow, so no merge-blocking impact is established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the main changes: updating Go to 1.26.9 and patching vulnerable modules across CI, Dockerfiles, and dependencies.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit checks the Go version pin,
Then hops through modules, line by line.
CI and builders match the tune,
Their tags now shine with 1.26.9.
The rabbit rests beneath the moon.}

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 31654ad...4c4ff0b on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 8, 2026 11:54p.m.	Review ↗
Go		Oct 8, 2026 11:54p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.