Build with patched Go toolchain

[zw5]

Summary

• raise the module Go directive to 1.26.2
• pin the GoReleaser workflow to Go 1.26.2
• update the Docker builder image from golang:1.25.5 to golang:1.26.2

Why

govulncheck ./... reported reachable public Go standard-library vulnerabilities when scanning the current tree, including crypto/x509, crypto/tls, and net/url findings fixed in Go 1.26.1/1.26.2. Building with Go 1.26.2 removes those reachable findings.

Verification

• go test ./...
• $(go env GOPATH)/bin/govulncheck ./... now reports 0 reachable vulnerabilities

[gemini-code-assist]

Code Review

This pull request updates the Go version to 1.26.2 in both the Dockerfile and go.mod. Feedback indicates that Go 1.26.2 is not an official release, which will likely cause build failures and toolchain issues. It is recommended to use a fully qualified image name in the Dockerfile if this is a custom toolchain and to use the 'toolchain' directive in go.mod to maintain compatibility with standard Go tools while pinning the specific version.

[gemini-code-assist]

The image golang:1.26.2 is not available on the official Docker Hub (the current stable Go version is 1.24). If this refers to a custom-built patched toolchain image, it is best practice to use a fully qualified image name (including the registry, e.g., ghcr.io/your-org/golang:1.26.2) to ensure the build is portable and reproducible across different environments. If this is a typo, please use a valid official Go version.

[gemini-code-assist]

The Go version 1.26.2 is not an official release. Using a non-existent version in the go directive will cause the Go toolchain to fail for most users. In Go 1.21 and later, the go directive should specify the minimum language version (e.g., 1.24), while the toolchain directive should be used to pin a specific toolchain version. This maintains compatibility with standard Go tools and IDEs while still enforcing the use of your patched toolchain for builds. Additionally, ensure you run go mod tidy to synchronize the module files.

Suggested change

	go 1.26.2
	go 1.24
	toolchain go1.26.2

[zw5]

Thanks for the review. go1.26.2 is an official Go release: the Go release history lists go1.26.2 as released on 2026-04-07 with security fixes (https://go.dev/doc/devel/release), and the official golang:1.26.2 Docker image resolves as a manifest list. I also rechecked this branch locally with go version reporting go1.26.2 darwin/arm64 and go test ./... passing.