fix(security): bump Go 1.26.4 → 1.26.5 for CVE-2026-39822 (#200)

Go 1.26.5 fixes CVE-2026-39822 (HIGH) — os.Root symlink following
vulnerability allows directory traversal.

Updated in: go.mod, Dockerfile, Makefile.

Author: bhatnitish

Dockerfile

@@ -11,7 +11,7 @@
 #  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
-ARG GOLANG_BASE_IMG=golang:1.26.4-alpine3.23
+ARG GOLANG_BASE_IMG=golang:1.26.5-alpine3.23
 ARG ALPINE_BASE_IMG=alpine:3.23.5
 FROM ${GOLANG_BASE_IMG}
 RUN apk --no-cache add git pkgconfig build-base libdrm-dev

Makefile

@@ -23,7 +23,7 @@ DEVICE_PLUGIN_TAG ?= $(IMAGE_VERSION)
 LABELLER_TAG ?= labeller-$(IMAGE_VERSION)
 UBI_DEVICE_PLUGIN_TAG ?= rhubi-$(IMAGE_VERSION)
 UBI_LABELLER_TAG ?= labeller-rhubi-$(IMAGE_VERSION)
-GOLANG_BASE_IMG ?= golang:1.26.4-alpine3.23
+GOLANG_BASE_IMG ?= golang:1.26.5-alpine3.23
 ALPINE_BASE_IMG ?= alpine:3.23.5
 
 # Output directory for tar.gz files

go.mod

@@ -1,6 +1,6 @@
 module github.com/ROCm/k8s-device-plugin
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/go-logr/logr v1.4.3