Upgrade Go 1.26.2 → 1.26.3 to fix stdlib vulnerabilities

[Copilot]

Go 1.26.2 has 7 known stdlib CVEs, two of which directly affect SBI (net/http via registry.go, net/http/httputil). Bumping the toolchain version in go.mod is sufficient — all CI workflows use go-version-file: go.mod.

Vulnerabilities fixed

ID	Package	Impact
GO-2026-4918	net/http	Infinite loop in HTTP/2 transport on bad SETTINGS_MAX_FRAME_SIZE
GO-2026-4976	net/http/httputil	ReverseProxy forwards excess query params
GO-2026-4981	net	Crash on long CNAME response
GO-2026-4977	net/mail	Quadratic string concat in consumePhrase
GO-2026-4986	net/mail	Quadratic string concat in consumeComment
GO-2026-4980	html/template	Escaper bypass → XSS
GO-2026-4982	html/template	XSS via meta content URL escaping bypass

Change

- go 1.26.2
+ go 1.26.3

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /dependabot-proxy /dependabot-proxy (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Mani Bindra (maniSbindra)]

lgtm