Bump Go to 1.26.10 and patch activesupport, rack, addressable

Merged
JE
7d ago
+9-9

The security workflow is red on every PR (including #233 and #234) because of new advisories, not anything those PRs changed. This fixes them at the source.

  • Go Vulnerability Check: GO-2026-6809 (crypto/x509 in the go1.26.9 stdlib) is fixed in go1.26.10. Bump the go directive in go/go.mod, conformance/runner/go/go.mod and go.work; every workflow's setup-go reads go-version-file: go/go.mod, so CI picks it up with no workflow change.
  • Bundler Audit / Trivy (Ruby): ruby/Gemfile.lock moves activesupport 8.1.2.1 → 8.1.4.1, rack 3.2.6 → 3.2.8, addressable 2.9.0 → 2.9.2 (bundle update --conservative, nothing else moved; BUNDLED WITH left at 4.0.13).

Locally: govulncheck ./... (v1.1.4, go1.26.10) reports no vulnerabilities; bundle-audit check --update reports none; Go tests and the Ruby suite (117 runs) pass.

No spec or generated code changes; nothing here needs a release on its own.

Summary by cubic

Fixes the security workflow that was failing on every PR due to new advisories unrelated to those PRs.

Bumps the Go toolchain from 1.26.9 to 1.26.10 across go.work, go/go.mod, and conformance/runner/go/go.mod to fix GO-2026-6809 (crypto/x509). CI picks this up automatically since setup-go reads go-version-file: go/go.mod.

Applies a conservative bundle update in ruby/Gemfile.lock, patching activesupport 8.1.2.1 → 8.1.4.1, rack 3.2.6 → 3.2.8, and addressable 2.9.0 → 2.9.2. Regenerated the lockfile with the locked Bundler (4.0.13), which a hand-edited BUNDLED WITH had left inconsistent and failing frozen installs on CI. govulncheck and bundle-audit report no vulnerabilities, and both test suites pass.