[devantler]

🤖 Generated by the Agentic Engineer

Why

A Go security fix for certificate validation (GO-2026-6809) was published today. Since then the daily vulnerability scan on main has failed, and every pull request that touches Go code fails the same scan. That blocks unrelated work across the repository.

What

Moves the platform's main Go module to Go 1.26.10, the release that contains the fix. Nothing else changes. The new admission module and the wider work in #5164 stay with their own pull request.

Part of #5164

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 53 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b5f2bf3e-2344-4814-af7a-a695a29d33ca

📥 Commits

Reviewing files that changed from the base of the PR and between 587aafb and b6ff468.

📒 Files selected for processing: 1

• go.mod

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T11:39:52.302015Z	b6ff468	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: b6ff468716

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at b6ff468716c88077e64629a8f26bda5fa8c2b353

• Tested: all 34 checks pass at this head (10 skipped by path filters), including CI - Required Checks (run 39593242085). No unresolved threads, no review-body findings, merge state CLEAN.
• Reviewed: Codex clean pass at this head (Reviewed commit: b6ff468716, no findings). CodeRabbit was rate-limited for this request, so it gave no verdict.
• Tried as a user: the user-facing result is that the scheduled Scan Go Vulnerabilities job on main stops failing on GO-2026-6809. At this head, 🛡️ Scan . (job) runs govulncheck on the root module and passes. The negative-control fixture scan also passes, so the scanner is still live. An earlier local run gave the same result: govulncheck was clean with Go 1.26.10 and reported GO-2026-6809 with 1.26.9.

Promoting, then adding it to the merge queue at this head.