build(deps): bump Go to 1.26.5 (fix GO-2026-5856) + x/term, docker, setup-go

[omattsson]

Root cause

Every workflow installs Go via go-version-file: cli/go.mod, which pinned go 1.26.4. So CI (incl. govulncheck) built with the 1.26.4 stdlib and failed GO-2026-5856 (crypto/tls, fixed in 1.26.5) on every PR — blocking #109/#110/#111.

Changes (consolidates all 3 open Dependabot PRs + the root fix)

• cli/go.mod go 1.26.4 → 1.26.5 ← unblocks govulncheck
• golang.org/x/term 0.44.0 → 0.45.0 (build(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 in /cli in the go-minor-patch group #110)
• Dockerfile golang 1.26.4-alpine → 1.26.5-alpine (build(deps): bump golang from 1.26.4-alpine to 1.26.5-alpine #109)
• actions/setup-go v6 → v7 across all workflows (build(deps): bump actions/setup-go from 6 to 7 in the actions group #111)

Verification (local, Go 1.26.5)

go mod tidy, go vet, go build, go test ./... all pass; govulncheck v1.1.4 → No vulnerabilities found.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Maintenance
  • Updated the Go toolchain to version 1.26.5.
  • Upgraded terminal and system support components for improved compatibility.
  • Refreshed automated build, test, release, and security checks to use the latest Go setup tooling.
• Build
  • Updated the container build environment to Go 1.26.5.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 27808255-72d8-444f-b4be-6b311f86664b

📥 Commits

Reviewing files that changed from the base of the PR and between 4298cc8 and ed6c48c.

⛔ Files ignored due to path filters (1)

• cli/go.sum is excluded by !**/*.sum, !**/go.sum

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• .github/workflows/live-tests.yml
• .github/workflows/release.yml
• .github/workflows/security.yml
• Dockerfile
• cli/go.mod

---

📝 Walkthrough

Walkthrough

The pull request updates the Go toolchain from 1.26.4 to 1.26.5, refreshes two Go module dependencies, and changes all GitHub Actions Go setup steps from actions/setup-go@v6 to @v7.

Changes

Go toolchain updates

Layer / File(s)	Summary
Toolchain and module versions Dockerfile, cli/go.mod	The Docker builder and module requirement use Go 1.26.5. golang.org/x/term and indirect golang.org/x/sys are updated.
Workflow Go setup actions .github/workflows/*.yml	CI, live-test, release, govulncheck, and CodeQL jobs use actions/setup-go@v7.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: the Go version bump and related updates to x/term, Docker, and setup-go.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deps/go-1.26.5-consolidated

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}