update go version for CVE-2026-25679

[ie-pham]

What this PR does: update go version for CVE-2026-25679

Which issue(s) this PR fixes:
Fixes #

Checklist

• Tests updated
• Documentation added
• CHANGELOG.md updated - the order of entries should be [CHANGE], [FEATURE], [ENHANCEMENT], [BUGFIX]

[Copilot]

Pull request overview

This PR aims to update the Go toolchain used by the repository’s tooling (tools module and tools image) to address CVE-2026-25679.

Changes:

• Bumps the Go version in tools/go.mod to 1.26.1.
• Updates the tooling Docker base image tag to golang:1.26.1-alpine.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
tools/go.mod	Raises the tools module’s minimum Go version to 1.26.1.
tools/Dockerfile	Switches the tools image base tag to Go 1.26.1 on Alpine (still digest-pinned).

[Copilot]

The FROM golang:1.26.1-alpine@sha256:... line keeps the exact same digest as the previous 1.26-alpine image. When a digest is pinned, Docker will pull the manifest referenced by the digest regardless of the tag, so this change may not actually upgrade the Go toolchain (and might not address the CVE). Update the digest to the one for golang:1.26.1-alpine, or drop the digest (less preferred) if you intend to track the tag.

Suggested change

	FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039
	FROM golang:1.26.1-alpine

[Copilot]

go 1.26.1 in tools/go.mod raises the module's minimum required Go version to 1.26.1, which is a compatibility change (and is now stricter than the repo root go 1.26.0). If the goal is to keep the language version at Go 1.26 but ensure the patched toolchain is used for the CVE, consider keeping go 1.26.0 (or go 1.26) and adding a toolchain go1.26.1 directive instead; otherwise, align the root go.mod as well so the repo doesn't have mixed minimum versions.

Suggested change

	go 1.26.1
	go 1.26.0
	toolchain go1.26.1

[tempo-ci-app]

The backport to release-v2.10 failed:

error cherry-picking: error running git cherry-pick: error running command 'git cherry-pick -x fa67dd687e0cf587997ec84fdacae2d07e76e74a'
error: exit status 1
stdout: Auto-merging Makefile
CONFLICT (content): Merge conflict in Makefile
Auto-merging build/tools.mk
CONFLICT (content): Merge conflict in build/tools.mk
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
Auto-merging tools/Dockerfile
CONFLICT (content): Merge conflict in tools/Dockerfile
Auto-merging tools/go.mod
CONFLICT (content): Merge conflict in tools/go.mod

stderr: error: could not apply fa67dd687... update go version for CVE-2026-25679 (#6779)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

To backport manually, run these commands in your terminal:

git fetch
git switch --create backport-6779-to-release-v2.10 origin/release-v2.10
git cherry-pick -x fa67dd687e0cf587997ec84fdacae2d07e76e74a

Resolve the conflicts, then add the changes and run git cherry-pick --continue:

git add . && git cherry-pick --continue

If you have the GitHub CLI installed:

git push --set-upstream origin backport-6779-to-release-v2.10
PR_BODY=$(gh pr view 6779 --json body --template 'Backport fa67dd687e0cf587997ec84fdacae2d07e76e74a from #6779{{ "\n\n---\n\n" }}{{ index . "body" }}')
echo "${PR_BODY}" | gh pr create --title '[release-v2.10] update go version for CVE-2026-25679' --body-file - --label 'backport' --label '' --base release-v2.10 --web

Or, if you don't have the GitHub CLI installed (we recommend you install it!):

git push --set-upstream origin backport-6779-to-release-v2.10

And open a pull request where the base branch is release-v2.10 and the compare/head branch is backport-6779-to-release-v2.10

[tempo-ci-app]

The backport to release-v2.10 failed:

error cherry-picking: error creating branch: error running command 'git checkout -b backport-6779-to-release-v2.10 origin/release-v2.10'
error: exit status 128
stdout: 
stderr: fatal: a branch named 'backport-6779-to-release-v2.10' already exists

To backport manually, run these commands in your terminal:

git fetch
git switch --create backport-6779-to-release-v2.10 origin/release-v2.10
git cherry-pick -x fa67dd687e0cf587997ec84fdacae2d07e76e74a

Resolve the conflicts, then add the changes and run git cherry-pick --continue:

git add . && git cherry-pick --continue

If you have the GitHub CLI installed:

git push --set-upstream origin backport-6779-to-release-v2.10
PR_BODY=$(gh pr view 6779 --json body --template 'Backport fa67dd687e0cf587997ec84fdacae2d07e76e74a from #6779{{ "\n\n---\n\n" }}{{ index . "body" }}')
echo "${PR_BODY}" | gh pr create --title '[release-v2.10] update go version for CVE-2026-25679' --body-file - --label 'backport' --label '' --base release-v2.10 --web

Or, if you don't have the GitHub CLI installed (we recommend you install it!):

git push --set-upstream origin backport-6779-to-release-v2.10

And open a pull request where the base branch is release-v2.10 and the compare/head branch is backport-6779-to-release-v2.10

[tempo-ci-app]

The backport to release-v2.10 failed:

error cherry-picking: error creating branch: error running command 'git checkout -b backport-6779-to-release-v2.10 origin/release-v2.10'
error: exit status 128
stdout: 
stderr: fatal: a branch named 'backport-6779-to-release-v2.10' already exists

To backport manually, run these commands in your terminal:

git fetch
git switch --create backport-6779-to-release-v2.10 origin/release-v2.10
git cherry-pick -x fa67dd687e0cf587997ec84fdacae2d07e76e74a

Resolve the conflicts, then add the changes and run git cherry-pick --continue:

git add . && git cherry-pick --continue

If you have the GitHub CLI installed:

git push --set-upstream origin backport-6779-to-release-v2.10
PR_BODY=$(gh pr view 6779 --json body --template 'Backport fa67dd687e0cf587997ec84fdacae2d07e76e74a from #6779{{ "\n\n---\n\n" }}{{ index . "body" }}')
echo "${PR_BODY}" | gh pr create --title '[release-v2.10] update go version for CVE-2026-25679' --body-file - --label 'backport' --label '' --base release-v2.10 --web

Or, if you don't have the GitHub CLI installed (we recommend you install it!):

git push --set-upstream origin backport-6779-to-release-v2.10

And open a pull request where the base branch is release-v2.10 and the compare/head branch is backport-6779-to-release-v2.10