From 160dbc3f5f22d98b1b7e4420075e07c2982eae9f Mon Sep 17 00:00:00 2001
From: Jeff Masud <jeff@deasil.works>
Date: Tue, 12 May 2026 07:28:21 -0700
Subject: [PATCH] chore: bump Go toolchain to 1.26.3

govulncheck flags two stdlib CVEs on the current 1.26.2 pin, blocking
PR merges via the Security CI job:

- GO-2026-4971: net.Dial / LookupPort panic on NUL byte (Windows)
- GO-2026-4918: net/http HTTP/2 transport infinite loop on bad
  SETTINGS_MAX_FRAME_SIZE

Both are explicitly listed as fixed in net@go1.26.3 / net/http@go1.26.3.
Bump go.mod's toolchain directive and every actions/setup-go pin in
the CI, CodeQL, and release workflows so they match. No code changes.

Dockerfile.dev pins golang:1.26-alpine and floats minor patches
automatically, so it doesn't need an edit.
---
 .github/workflows/ci.yml      | 12 ++++++------
 .github/workflows/codeql.yml  |  2 +-
 .github/workflows/release.yml |  2 +-
 go.mod                        |  2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7954a3c..991f9f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.2"
+          go-version: "1.26.3"
           cache: true
 
       - name: Run golangci-lint
@@ -62,7 +62,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.2"
+          go-version: "1.26.3"
           cache: true
 
       - name: Verify go.mod is tidy
@@ -107,7 +107,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.2"
+          go-version: "1.26.3"
           cache: true
 
       - name: Build
@@ -165,7 +165,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.2"
+          go-version: "1.26.3"
           cache: true
 
       - name: gosec
@@ -176,7 +176,7 @@ jobs:
       - name: govulncheck
         uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
         with:
-          go-version-input: "1.26.2"
+          go-version-input: "1.26.3"
           repo-checkout: false
 
       - name: Semgrep
@@ -207,7 +207,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.2"
+          go-version: "1.26.3"
           cache: true
 
       - name: Run integration tests
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7fdda7c..3cbc485 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.2"
+          go-version: "1.26.3"
           cache: true
 
       - name: Initialize CodeQL
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 18285f4..39dbf92 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.2"
+          go-version: "1.26.3"
           cache: true
 
       - name: Set up Node (for SPA build)
diff --git a/go.mod b/go.mod
index 407e000..5f8f9d9 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/plexara/mcp-test
 
-go 1.26.2
+go 1.26.3
 
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1