chore(deps): docker: bump golang from 1.26.3-bookworm to 1.26.4-bookworm in /agent in the all-docker group across 1 directory

[dependabot]

Bumps the all-docker group with 1 update in the /agent directory: golang.

Updates golang from 1.26.3-bookworm to 1.26.4-bookworm

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[scottschreckengaust]

Verdict

Approve. A clean, single-line Dependabot patch bump of the gh-builder base image (golang:1.26.3-bookworm → 1.26.4-bookworm) that pulls a security-relevant Go toolchain forward. CI is fully green including build (agentcore), which actually exercises this Dockerfile.

Vision alignment

Advances the bounded blast radius & supply-chain hygiene posture. The gh-builder stage exists specifically to compile gh from source on a patched Go toolchain because upstream gh packages lag Go CVE fixes (agent/Dockerfile:6). Bumping the Go patch release is precisely the mechanism that keeps the shipped gh binary current — this change is doing exactly what the stage was designed to do. No tenet is traded; no ADR/RFC required.

Blocking issues

None.

Non-blocking suggestions / nits

• Branch name (dependabot/docker/agent/all-docker-b383ab5a52) does not follow the (feat|fix|chore|docs)/<issue>-desc convention. This is a de-facto-waived nit for Dependabot-managed PRs (the bot names branches; .github/dependabot.yml owns the all-docker group) — not a blocker.
• Governance: No backing approved issue, which is expected and acceptable — automated dependency bumps from Dependabot are exempt from the ADR-003 manual issue gate. The bump is authorized by .github/dependabot.yml (docker ecosystem, all-docker group, 7-day cooldown).

Documentation

No docs impact. A base-image patch tag inside a builder stage changes no behavior, contract, env var, or command. Starlight mirror unaffected. No issue-tracking gap (Dependabot-driven).

Tests & CI

• All checks green: build (agentcore) SUCCESS (compiles gh v2.93.0 against Go 1.26.4 — proves no toolchain incompatibility), Secrets, deps, and workflow scan SUCCESS, Validate PR title SUCCESS, CodeQL NEUTRAL, dead-code advisory SUCCESS.
• No unit tests apply to a Docker tag bump; none expected. The image build IS the test here and it passed.
• Bootstrap synth-coverage: Not applicable — no CDK construct, stack, or CloudFormation resource-type change.
• Version delta verified: Go 1.26.4 is a legitimate upstream patch release carrying security fixes to crypto/x509, mime, and net/textproto plus compiler/runtime/crypto/fips140 bug fixes. Semver-patch, no breaking changes; Dependabot compatibility applies. The green agentcore build confirms no real incompatibility (per the dep-bump investigation requirement, there was no red build to root-cause).

Review agents run

The diff is a single Docker FROM tag change (one line, no application code). Agents were evaluated for scope:

• code-reviewer — Omitted: no TS/Python/logic changed; only a base-image tag.
• silent-failure-hunter — Omitted: no error-handling or fallback code in the diff.
• type-design-analyzer — Omitted: no new/changed types.
• comment-analyzer — Omitted: no comments added or modified (the adjacent # Build gh with a patched Go toolchain comment is unchanged and remains accurate).
• pr-test-analyzer — Omitted: no testable code unit; the image build in CI is the coverage.
• /security-review — Omitted as a formal invocation: no IAM/Cedar/network/secrets/input-gateway change. Applied supply-chain judgment by hand instead — the bump reduces attack surface (newer Go security patches into the gh binary), the tag is a pinned Debian-based official image, and Dependabot's security scan passed.

Human heuristics

• Proportionality — Pass. One-line tag bump for a one-line concern; no incidental abstraction.
• Coherence — Pass. Belongs in agent/Dockerfile (the only golang reference in the repo); consistent with the existing patch-Go-toolchain intent.
• Clarity — Pass. Intent is self-evident and the surrounding comment (agent/Dockerfile:6) still accurately explains why the stage pins Go.
• Appropriateness — Pass. Maintainable, Dependabot-managed, verified against the real Go 1.26.4 release notes and a real green image build rather than a mock.