Sets toolchain go1.26.11 in go.mod. The go line stays 1.26.7, and no other file pins 1.26.10.
Why
govulncheck reports GO-2026-6859 (net/http) in the Go 1.26.10 standard library, fixed in 1.26.11. The required Security check has been failing on main and on every open pull request since the advisory was published. setup-go reads the toolchain line, so every CI and release job builds and scans with 1.26.11 once this lands.
Verified
govulncheck -tags dev ./... finds no vulnerabilities under 1.26.11, and reports GO-2026-6859 again when forced back to 1.26.10.
bin/ci on a clean checkout of this branch.
Not verified
The Nix build. flake.lock is not touched, so Nix builds keep the Go their nixpkgs pin gives them.
Summary by cubic
Bumps the Go toolchain to 1.26.11 so govulncheck stops reporting GO-2026-6859 (net/http), which has been failing the Security check on main and every open PR. The go line stays at 1.26.7; only the toolchain directive changes.
Confidence Score: 5/5
This PR appears safe to merge.
Summary
Updates go.mod from toolchain go1.26.10 to toolchain go1.26.11, while keeping go 1.26.7.
