Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

Dependency Bump Evaluation

Version change: Go 1.26.4 → 1.26.5 (patch)
Semver bump type: patch

Changes:

• Security fix in crypto/tls: omit PSK in ECH outer client hello (#80175)
• Security fix in os: Root escape via symlink plus trailing slash — CVE-2026-39822 (#79027)
• Runtime bug fixes: moveSliceNoCap, AVX-512 SIGILL in GC span-scan, version parsing, concurrent map read/write on ppc64le, SIGSEGV in fork pre-exec with -race on darwin/arm64
• os/signal: signal.NotifyContext error cause now correctly matches context.Canceled (#79499)
• Tooling: go get fix with GOFIPS140, test caching fix with testing.T.Chdir
• Docker base image digest updates (golang, devcontainers/go)

Breaking changes: None

Security concerns: Contains two security fixes (CVE-2026-39822 for os.Root path traversal, and a crypto/tls ECH/PSK fix). This codebase does not use os.Root/os.OpenRoot or crypto/tls directly, so neither vulnerability is exploitable through this adapter. Still, updating promptly is good practice.

Impact on codebase:

• signal.NotifyContext is used in cmd/main.go — the bug fix (#79499) ensures the returned error cause correctly matches context.Canceled, which improves correctness of signal-driven shutdown
• No usage of os.Root, os.OpenRoot, os.DirFS, or crypto/tls found
• No other affected APIs detected

Recommendation: SAFE TO MERGE

Notes: Patch-only Go release with security and bug fixes, no breaking changes. All CI checks pass (lint ✅, test ✅, build ✅). The signal.NotifyContext fix is a minor correctness improvement for the adapter's shutdown path. Merge promptly to pick up the security fixes.

— Claude Code