[sre-helmcode]

Summary

Raises the go directive from 1.26.9 to 1.26.10 to fix GO-2026-6809 (crypto/x509 trusting compromised intermediate certificates). Every HTTPS call this CLI makes can reach the affected code. The README and CONTRIBUTING lines that state the minimum Go version are updated to match. No dependency changes: go.sum is untouched.

Why now

The Known vulnerabilities job (govulncheck@v1.8.0) is a failing check, and today it fails on main. Every push to main therefore leaves CI red. tag.yml only runs after CI passes on main, so nothing can be released until this is fixed.

govulncheck on main (b3aea03):

Vulnerability #1: GO-2026-6809
    Distrust compromised intermediate certificates in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-6809
  Standard library
    Found in: crypto/x509@go1.26.9
    Fixed in: crypto/x509@go1.26.10
    Example traces found:
      #1: internal/api/runs.go:805:20: api.activityReader.Read calls http.readWriteCloserBody.Read, which eventually calls x509.Certificate.Verify

Your code is affected by 1 vulnerability from the Go standard library.

govulncheck on this branch:

No vulnerabilities found.

Release

This PR does not publish a release. internal/tui.Version stays at 0.1.34, and the v0.1.34 tag already exists, so after CI passes on main, tag.yml reports that the tag is already published and stops. The fixed toolchain ships with the next version bump.

The user merges this PR.

Checks

Reproduced locally from .github/workflows/ci.yml with go1.26.10, fetched by GOTOOLCHAIN=auto:

• gofmt -l . is clean
• go mod verify passes
• go vet ./... passes
• go test -race -shuffle=on ./... passes
• the build cross-compiles for linux, darwin and windows on amd64 and arm64
• govulncheck@v1.8.0 finds no vulnerabilities

#60 carries the same commit so that its CI stays green; a rebase drops it once this is merged.

🤖 Generated with Claude Code