ROSAENG-61450 | chore: bump go.mod to 1.26.5

[amandahla]

PR Summary

Bump go.mod (and related pins) to Go 1.26.5 as the follow-up to #3366. Also drops deferred stdlib Snyk/govulncheck ignores fixed in Go >= 1.26.4.

Depends on: openshift/release#81830 (from: rosa-clients). Do not merge this until that release PR is in, or Prow may fail with go.mod requires go >= 1.26.5 (running go 1.26.3; GOTOOLCHAIN=local).

Also covers / supersedes: #3382 (Darkstar stdlib CVE bump to 1.26.4) — 1.26.5 includes those fixes.

Detailed Description of the Issue

#3366 aligned Dockerfiles on ubi9/go-toolset:1.26.5 but left go.mod at 1.26.3 so existing from: src jobs kept passing. After release wires rosa-clients, go.mod can move to 1.26.5.

Related Issues and PRs

• Jira: ROSAENG-61450
• Depends on: ROSAENG-61450: wire rosa-clients for openshift/rosa CI release#81830
• Parent: ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 #3366
• Fixes / supersedes: [Project Darkstar] ROSAENG-60658: Remediate CVE-2026-27145, CVE-2026-42504 in rosa #3382 (ROSAENG-60658 stdlib CVEs; we bump to 1.26.5 instead of 1.26.4)

Type of Change

• feat - adds a new user-facing capability.
• fix - resolves an incorrect behavior or bug.
• docs - updates documentation only.
• style - formatting or naming changes with no logic impact.
• refactor - code restructuring with no behavior change.
• test - adds or updates tests only.
• chore - maintenance work (tooling, housekeeping, non-product code).
• build - changes build system, packaging, or dependencies for build output.
• ci - changes CI pipelines, jobs, or automation workflows.
• perf - improves performance without changing intended behavior.

Previous Behavior

go.mod / bingo / renovate Go constraint at 1.26.3; stdlib Snyk and govulncheck ignores deferred until Go >= 1.26.4. Dockerfiles already on go-toolset 1.26.5 from #3366.

Behavior After This Change

• go.mod → 1.26.5
• .bingo/*.mod → 1.26.5
• renovate.json gomod.constraints.go → 1.26.5
• Removed deferred stdlib entries from .snyk and .govulncheck-ignore.yaml
• Dockerfiles / .ci-operator.yaml unchanged (already 1.26.x from ROSAENG-61450 | ci: add presubmit client image and go-toolset 1.26.5 #3366)

How to Test (Step-by-Step)

Preconditions

• Go 1.26.5 (e.g. mise exec go@1.26.5 -- …)
• Prefer after openshift/release#81830 merges

Test Steps

1. mise exec go@1.26.5 -- bash -lc 'export GOTOOLCHAIN=auto && make fmt-check && make rosa && make lint && make test'
2. Optional: podman build -f Dockerfile.clients -t rosa-clients:local . then no-mount make rosa

Expected Results

Local checks pass; after release PR, Prow build/lint/test pass on go-toolset 1.26.5.

Proof of the Fix

• Local: fmt-check, rosa, lint, test passed on Go 1.26.5
• CodeRabbit (coderabbit --agent -t uncommitted): 0 findings
• govulncheck source scan clean; binary still reports pre-existing GO-2026-5932 in golang.org/x/crypto (no fix available)

Breaking Changes

• No breaking changes
• Yes, this PR introduces a breaking change (describe impact and migration plan below)

Developer Verification Checklist

• Commit subject/title follows [JIRA-TICKET] | [TYPE]: <MESSAGE>.
• PR description clearly explains both what changed and why.
• Relevant Jira/GitHub issues and related PRs are linked.
• make install-hooks has been run in this clone.
• Tests were added/updated where appropriate.
• I manually tested the change.
• make test passes.
• make lint passes.
• make rosa passes.
• Documentation or repo-local agent guidance was added/updated where appropriate.
• Any risk, limitation, or follow-up work is documented.

Made with Cursor

Summary by CodeRabbit

• Chores
  • Updated the project’s Go toolchain requirements to version 1.26.5.
  • Updated related development tooling configurations to use the same Go version.
  • Removed previously configured vulnerability suppressions, enabling those findings to be reported again.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amandahla

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [amandahla]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c72da800-a4ea-4ae5-93f4-795057cc3cc1

📥 Commits

Reviewing files that changed from the base of the PR and between 3bb1e1a and 0431ecf.

📒 Files selected for processing (11)

• .bingo/bingo.mod
• .bingo/gci.mod
• .bingo/go-bindata.mod
• .bingo/golangci-lint.mod
• .bingo/goreleaser.mod
• .bingo/govulncheck.mod
• .bingo/mockgen.mod
• .govulncheck-ignore.yaml
• .snyk
• go.mod
• renovate.json

💤 Files with no reviewable changes (1)

• .snyk

---

📝 Walkthrough

Walkthrough

Updated the main Go module, seven .bingo tool modules, and Renovate’s Go constraint from earlier versions to Go 1.26.5. Removed the configured vulnerability suppressions from .govulncheck-ignore.yaml and .snyk.

Possibly related PRs

• openshift/rosa#3382: Updates the go.mod toolchain directive from Go 1.26.3 to 1.26.4.

Suggested reviewers: olucasfreitas

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the PR's main change and follows the required ticket/type format.
Description check	✅ Passed	The description covers all required sections with clear context, related links, validation, and change impact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Go test files or Ginkgo title changes are in the PR diff; only toolchain/config files changed, so no unstable test names were introduced.
Test Structure And Quality	✅ Passed	PR changes only toolchain/config files; no Ginkgo or _test.go files were touched, so test-structure rules are not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; the PR only bumps Go/tooling versions and removes vuln ignores, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo/e2e tests were added or modified; the PR only bumps Go versions and removes vuln ignores, so SNO compatibility is not impacted.
Topology-Aware Scheduling Compatibility	✅ Passed	Only Go/tooling config and vuln-ignore files changed; no deployment manifests, controllers, or scheduling logic were modified.
Ote Binary Stdout Contract	✅ Passed	PR only changes Go/tooling config and ignore files; no source or suite-setup code was modified, so no new stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo/e2e test files were added or modified; the PR only changes Go/tooling config and vuln-ignore files, so it introduces no IPv4 or external-connectivity risk.
No-Weak-Crypto	✅ Passed	Only Go version/ignore-list files changed; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or token comparisons were added.
Container-Privileges	✅ Passed	No container/K8s manifests were changed, and the diff contains no privileged settings (privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/allowPrivilegeEscalation).
No-Sensitive-Data-In-Logs	✅ Passed	The commit only bumps Go version/config files and removes vuln ignore entries; no logging statements or sensitive data were added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}