chore: bump go to 1.26

[barnabasbusa]

Go 1.25 is out of support since the Go 1.27 release, and tools are starting to drop it: staticcheck@latest (v0.8.x) requires go 1.26, so the code checks of every PR currently fail at the install step. This moves the module (go 1.26.9, the first 1.26 patch release without known stdlib vulnerabilities), the CI and build workflows and both Dockerfiles to Go 1.26. The pinned golangci-lint v2.11.3 is built with go 1.26.1 and reports no issues; vet, gofmt, staticcheck v0.8.2 and go test -race pass locally on go 1.26.9.

https://claude.ai/code/session_01B7h25qcCifoGJpJGMDge43

[redpandabot]

Summary

Mechanical Go 1.25 → 1.26 bump across the module, both Dockerfiles, the CI/build workflows and the setup docs. Everything is consistent except go.mod: it declares go 1.26.0, which OSV flags with 46 stdlib vulnerabilities (13 unfixed until 1.26.9), while the PR description says the module was moved to go 1.26.9.

Issues

• 🔴 go.mod:3 — go directive pins vulnerable go 1.26.0 instead of the described 1.26.9 — see the thread on that line

---

_{Reviewed @ 5b20c1df
"In theory, there is no difference between theory and practice. In practice, there is." — attributed to Yogi Berra}

[redpandabot]

Mechanical Go 1.25 → 1.26 bump: go.mod directive raised to 1.26.9, all five CI go-version pins, both Dockerfiles and the setup docs updated consistently, with no leftover 1.25 references and no go.sum/toolchain churn. Go 1.26.9 is a real published release and OSV reports no known stdlib vulnerabilities for [email protected]; the golang:1.26 docker tag and setup-go 1.26.x both resolve to ≥1.26.9 so the directive is satisfiable everywhere it builds. The only commit since the last review just raised the directive to 1.26.9; no issues found.

---

_{Reviewed 6 changed file(s) @ f27d3a3c — no blocking issues found.
"In theory, there is no difference between theory and practice. In practice, there is." — attributed to Yogi Berra}

[redpandabot]

CI failed @ f27d3a3c

1 failed job diagnosed: 1 pr_change, 0 flaky, 0 infrastructure, 0 pre_existing, 0 unknown.

• Check PR / Run code checks / Run code checks — caused by this PR — The PR bumps go.mod from 'go 1.25.7' to 'go 1.26.9' while the workflow's setup-go uses 'go-version: 1.26.x', which resolved to go1.26.8 on the runner (log lines 141-150: 'Found in cache @ /opt/hostedtoolcache/go/1.26.8/x64', 'go version go1.26.8'). The runner environment sets GOTOOLCHAIN=local (log lines 193 and 205; not set anywhere in the repo), disabling automatic toolchain download, so 'go mod verify' failed with 'go: go.mod requires go >= 1.26.9 (running go 1.26.8; GOTOOLCHAIN=local)' (log line 207). Verified via gh api that tag go1.26.9 exists in golang/go; setup-go's manifest/image simply lagged the release. On master, go.mod (1.25.7) and the workflow (1.25.x) match, so this failure can only arise from this PR's go.mod line. (go.mod:3) — Change go.mod line 3 from 'go 1.26.9' to 'go 1.26.8' (or 'go 1.26') so the directive matches what setup-go's '1.26.x' resolves to; no workflow change needed. Pinning the workflow to 1.26.9 is not minimal since setup-go may not yet resolve that version.

---

_{Diagnosed Check PR @ f27d3a3c
"In theory, there is no difference between theory and practice. In practice, there is." — attributed to Yogi Berra}