[manusa]

Description

Bumps the Go toolchain used for all native builds from 1.26.7 to 1.26.10, in preparation for the v0.0.22 release.

GO_VERSION is updated everywhere it's pinned: .github/workflows/build.yml, release.yml, snapshots.yml and the Makefile default, which also drives the xgo image tag (ghcr.io/techknowlogick/xgo:go-1.26.10 exists). The go directive in native/go.mod stays at 1.26.0. AGENTS.md (and so CLAUDE.md) had stale Helm and Go versions; they now match main.

Go standard library vulnerabilities fixed

Go 1.26.7 is affected by these; 1.26.9 or 1.26.10 fixes them (source: vuln.go.dev):

Fixed in 1.26.9:

• GO-2026-6599 (CVE-2026-94448): html/template context tracking reset on consecutive template expressions
• GO-2026-6600 (CVE-2026-97030): html/template yield regexp-preceder keyword
• GO-2026-6603 (CVE-2026-78659): net/http HTTP/2 server memory exhaustion via Trailer headers
• GO-2026-6604 (CVE-2026-56857): os Root.Mkdir(All) can follow junctions out of the root on Windows
• GO-2026-6605 (CVE-2026-56866): net/http HTTP/1 client connection desync after CONNECT rejection
• GO-2026-6607 (CVE-2026-97031): crypto/tls malformed ECH outer extension references
• GO-2026-6608 (CVE-2026-94440): net/textproto, mime/multipart memory limit bypass when parsing MIME headers
• GO-2026-6609 (CVE-2026-78667): net/http no limit on parsed Range header size
• GO-2026-6610 (CVE-2026-78660): net/http HTTP/2 transport accepts malformed framing-related headers
• GO-2026-6611 (CVE-2026-78669): net/http HTTP/2 excessive CPU from repeated initial window changes
• GO-2026-6612 (CVE-2026-78663): net/http HTTP/2 double flow-control refund on server streams
• GO-2026-6613 (CVE-2026-94439): net/http HTTP/1 server connection desync after 2xx CONNECT response
• GO-2026-6617 (CVE-2026-97032): net/http HTTP/2 server crash due to HPACK encoder race

Fixed in 1.26.10:

• GO-2026-6809 (CVE-2026-111943): crypto/x509 distrust of compromised intermediate certificates

Type of change

• Chore (dependency / build toolchain)