chore(deps): bump Go 1.26.4, x/text v0.39.0, fix CI security scanners

- go directive: 1.26.3 → 1.26.4 (fixes OSV GO-2026-5037, GO-2026-5039)
- golang.org/x/text: v0.38.0 → v0.39.0 (fixes Trivy CVE-2026-56852)
- CI workflows: go-version '1.26' → '~1.26' for automatic patch pickup
- osv-scanner.toml: ignore GO-2026-4970, GO-2026-5856 (fixed in 1.26.5,
  not yet available in MegaLinter container; govulncheck warning is non-fatal)

Author: kehoecj

.github/workflows/go.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.26"
+          go-version: "~1.26"
 
       - name: Download dependencies
         run: go mod download
@@ -47,7 +47,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.26"
+          go-version: "~1.26"
 
       - name: Static Analysis
         run: go vet ./...
@@ -74,7 +74,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.26"
+          go-version: "~1.26"
 
       - name: Generate known files from Linguist
         run: go generate ./pkg/filetype/...
@@ -99,7 +99,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.26"
+          go-version: "~1.26"
 
       - name: Unit test
         run: go test -v -cover -coverprofile coverage.out ./...

.github/workflows/golangci-lint.yml

@@ -16,7 +16,7 @@ jobs:
   golangci:
     strategy:
       matrix:
-        go: ["1.26"]
+        go: ["~1.26"]
         os: [ubuntu-latest, macos-latest, windows-latest]
     permissions:
       # Optional: Allow write access to checks to allow the action to annotate code in the PR.

.github/workflows/linguist.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Go Setup
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.26"
+          go-version: "~1.26"
 
       - name: Fetch latest Linguist SHA
         id: fetch-sha

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version: "1.26"
+          go-version: "~1.26"
 
       - name: Update SchemaStore catalog
         run: |

go.mod

@@ -54,7 +54,7 @@ require (
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/sync v0.21.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )

go.sum

@@ -126,10 +126,10 @@ golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
 golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

osv-scanner.toml

@@ -1,4 +1,14 @@
+# osv-scanner configuration
+# https://google.github.io/osv-scanner/configuration/
+
+# Go stdlib vulnerabilities fixed in 1.26.4+. MegaLinter's container ships
+# Go 1.26.3 and sets GOTOOLCHAIN=local. Remove these once the container updates.
 [[IgnoredVulns]]
-id = "GHSA-h67p-54hq-rp68"
-reason = "js-yaml 3.14.2 is a transitive dependency of Docusaurus; waiting for upstream fix"
-ignoreUntil = "2026-10-07T00:00:00Z"
+id = "GO-2026-4970"
+reason = "Go stdlib — waiting for MegaLinter container to ship 1.26.4+"
+ignoreUntil = "2026-10-16T00:00:00Z"
+
+[[IgnoredVulns]]
+id = "GO-2026-5856"
+reason = "Go stdlib — waiting for MegaLinter container to ship 1.26.4+"
+ignoreUntil = "2026-10-16T00:00:00Z"