Upgrade Go to 1.26.6 to fix CVE-2026-56858 [release-1.8]

[midays]

Summary

• Upgrades Go from 1.25.0 to 1.26.6 to fix html/template XSS vulnerability
• Updates Dockerfile to use explicit golang:1.26.6-alpine instead of quay.io/konveyor/builder:latest

CVE Fixed

• MIG-1987: CVE-2026-56858 - Go html/template: Cross-Site Scripting via pathological input
  • Affected: Go 1.26.0 to 1.26.5
  • Fixed in: Go 1.26.6+

Changes

• Updated Dockerfile: FROM quay.io/konveyor/builder:latest → FROM golang:1.26.6-alpine
• Added build dependencies for CGO builds (gcc, musl-dev, git)
• Updated go.mod: go 1.25.0 → go 1.26

Jira Ticket

• https://redhat.atlassian.net/browse/MIG-1987

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e80961b1-6a15-4cf8-9a66-a2bc223d84aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[awels]

I am not sure the U/S pipeline can get this container without a pull secret.