chore: update go toolchain directive to v1.26.5 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	toolchain	patch	1.26.4 → 1.26.5

---

Root escape via symlink plus trailing slash in os

CVE-2026-39822 / GO-2026-4970

More information

Details

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Severity

Unknown

References

• https://go.dev/issue/79005
• https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
• https://go.dev/cl/797880

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking Encrypted Client Hello privacy leak in crypto/tls

CVE-2026-42505 / GO-2026-5856

More information

Details

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Severity

Unknown

References

• https://go.dev/cl/775960
• https://go.dev/issue/79282
• https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

golang/go (go)

v1.26.5

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.