chore(deps): update all Go dependencies and bump to Go 1.26 [RED-694]

[sorccu]

Linear: RED-694

Brings every Go module to its latest version, and moves the provider to Go 1.26.

Although dependabot runs daily against gomod, four of its PRs had stalled and go.mod had fallen behind. Nearly all of that came from one dead dependency.

Dropping terratest

gruntwork-io/terratest was imported by exactly one file, checkly/integration_test.go, behind a //go:build integration tag that nothing ever sets — not GNUmakefile, not any workflow. That test also ran terraform.InitAndApply against TerraformDir: "../", and the repo root has had no .tf files since e513ed6, so it could not have passed even if it had run.

Via hashicorp/go-getter, terratest pulled in aws-sdk-go, ~60 cloud.google.com/go/* modules, OpenTelemetry, spiffe and envoyproxy. Deleting the test drops all of them: go.sum loses 918 lines net.

This is what dependabot #376 could not do — terratest v1 requires Go >= 1.26, which is why that PR is red.

Go 1.26

go.mod moves to go 1.26.0, with the four go-version pins in test.yml and release.yml following.

The bump surfaced two pre-existing fmt.Errorf bugs, fixed in their own commit before the bump so each commit is independently green:

• resource_check_group_v2.go passed an int64 group id to %q, which renders a quoted rune rather than a number.
• resource_playwright_code_bundle.go passed a *PlaywrightCodeBundleMetadata to %q, which renders %!q(...).

Both are gated on the module's language version, not the toolchain: at go 1.25.8 vet is silent, at go 1.26.0 both fire. go test runs the printf analyzer, so CI would have gone red without them.

codeql-analysis.yml has no setup-go step, so GOTOOLCHAIN stays at its default of auto there and the runner fetches 1.26 on demand.

Module updates

The only direct bump is Masterminds/semver/v3 3.2.0 → 3.5.0 (supersedes dependabot #373). The rest is the indirect tail under terraform-plugin-sdk/v2 and terraform-plugin-docs.

Two results in go.mod look odd but are correct:

• sprig 3.3.0 moves from imdario/mergo to dario.cat/mergo; go-cty 1.19.0 moves from go-textseg/v15 to /v17, while hcl/v2 still requires v15, so both majors are present.
• testify drops out — it survives only as a test-only dependency of go-hclog, which module graph pruning excludes.

Note that grpc (1.79.3 → 1.82.0) and go-plugin (1.7.0 → 1.8.0) now sit ahead of the versions terraform-plugin-sdk/v2 v2.40.1 pins. Dependabot's gomod ecosystem runs daily with no ignore list, so it would open these bumps regardless; a groups block in dependabot.yml would be a reasonable follow-up.

Verification

Beyond CI: docs regenerate byte-identically under the upgraded tfplugindocs, and the full acceptance suite passes against a real Checkly account (156s), which is what actually exercises the grpc / go-plugin / go-cty bumps on the provider's serving path.

Other changes

CONTRIBUTING.md still asked for Go >= 1.18.2. A contributor following it would hit a hard go.mod requires go >= 1.26.0 error with no graceful recovery, since toolchain auto-download only exists on Go >= 1.21.

Follow-up

Dependabot should close #376 and #373 once this lands. #374 and #346 remain open and valid — GitHub Actions bumps were out of scope here.

🤖 Generated with Claude Code