Security: Fix stdlib CVEs (go1.26.6)

[divyansh42]

Changes

Bump Go stdlib from go 1.26.5 to go 1.26.6 to fix four vulnerabilities confirmed by govulncheck on the main branch.

Vulnerabilities fixed:

Advisory	Package	Description	Severity
GO-2026-6218	net/url	Quadratic complexity in resolvePath	Important (CVSS 7.5)
GO-2026-6090	crypto/tls	Unbounded post-handshake messages	Important (CVSS 7.5)
GO-2026-5972	encoding/asn1	Missing max recursion depth	Important (CVSS 7.5)
GO-2026-5026	net/http	Punycode-encoded label rejection in idna	Important (CVSS 7.5)

Already fixed on this branch:

• GHSA-hrxh-6v49-42gf (grpc v1.82.1) — already at fixed version
• CVE-2026-56852 (x/text) — already at v0.40.0 > 0.39.0
• CVE-2026-46600 (x/net) — already at v0.57.0 > 0.56.0

Related Jira: SRVKP-13176 (FedRAMP ConMon scan — pipelines-cli-tkn-rhel9)

govulncheck Scan (pre-fix)

Tool: govulncheck v1.7.0, GOTOOLCHAIN=go1.26.5
GO-2026-6218 (net/url): Found in go1.26.5 → Fixed in go1.26.6
GO-2026-6090 (crypto/tls): Found in go1.26.5 → Fixed in go1.26.6
GO-2026-5972 (encoding/asn1): Found in go1.26.5 → Fixed in go1.26.6
GO-2026-5026 (net/http): Found in go1.26.5 → Fixed in go1.26.6

Changes Applied

• go.mod: go 1.26.5 → go 1.26.6
• go mod tidy ✅
• go mod verify ✅ (all modules verified)
• go mod vendor ✅

Submitter Checklist

• Includes tests (dependency-only update, no logic changes)
• Run the code checkers with make check
• Regenerate the manpages, docs and go formatting with make generated
• Commit messages follow commit message best practices

Unit Test Results

Status: ⚠️ Pre-existing failures in hub tests (unrelated to this change — user: unknown userid 1009320000 is a container environment issue present on the unmodified main branch too)

All other ./pkg/... packages: PASSED ✅

Release Notes

NONE

---

🤖 Generated by CVE Fixer Workflow

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from divyansh42 after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment