Summary

This PR upgrades the Go version from 1.26.1 to 1.26.2 to address a critical security vulnerability in the crypto/x509 package.

Vulnerability Details:

• Package: stdlib (crypto/x509)
• Issue: Denial of Service via inefficient certificate chain validation
• Description: Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
• Affected Version: v1.26.1
• Fix Versions: 1.25.9, 1.26.2

Changes Made:

• Updated go.mod: Go directive from 1.26.1 to 1.26.2
• Updated Dockerfile: Both golang base images from golang:1.26.1-alpine3.22 to golang:1.26.2-alpine3.22

Testing

All tests and builds completed successfully:

✅ go mod tidy: Completed with no dependency changes (go.sum unchanged)
✅ Build: CLI binary compiled successfully (117MB)
✅ Unit tests: All tests passed with no regressions
✅ Docker build: Image built successfully (749MB) and tested

Test command outputs:

# All unit tests passed
go test ./pkg/... ./cmd/command/...
# Result: PASS for all test packages

# Build successful
go build -ldflags "-s -w" -o plural.o ./cmd/plural
# Result: 117MB binary created

# Docker build successful
docker build -t plural-cli:test -f Dockerfile .
# Result: 749MB image created and verified

Impact

• No breaking changes: Only the Go version was updated
• No dependency changes: go.sum remains unchanged
• No code changes: Only infrastructure files modified
• Security improvement: Fixes CVE in crypto/x509 certificate chain validation

This is a minimal, security-focused upgrade with no functional changes to the codebase.