[zzwong]

Summary

• Raise the minimum Go patch release from 1.26.8 to 1.26.9 in go.mod and the two development/install references.
• Apply the October 8 standard-library/toolchain security release without changing third-party module versions or go.sum.
• Keep Dependabot build(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 in the go-dependencies group across 1 directory #37 (x/term and x/sys), Actions updates build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 #35–36, and pagination fix: reject incomplete and cyclic Green Button pagination #38 separate.

Security evidence

Official release: https://go.dev/doc/devel/release#go1.26.9

On Linux/amd64, govulncheck v1.9.0 against unchanged main sources using Go 1.26.8 reports nine symbol-level standard-library findings: GO-2026-6617, GO-2026-6613, GO-2026-6612, GO-2026-6611, GO-2026-6610, GO-2026-6608, GO-2026-6607, GO-2026-6605, and GO-2026-6603. It also reports two uncalled imported-package findings (GO-2026-6609, GO-2026-6604) and two uncalled module findings (GO-2026-6600, GO-2026-6599). Every listed finding is fixed in Go 1.26.9. These are scanner classifications, not nine demonstrated exploitable application attacks.

The candidate using Go 1.26.9 reports No vulnerabilities found, both for govulncheck ./... and module-level scanning from cmd/coned. Existing binaries must be rebuilt with the patched toolchain; this PR does not replace already-published release assets.

Local verification

All run with exact pinned modules and isolated caches/home; official Go 1.26.9 archive SHA256 verified before use, module checksums verified.

• go mod verify
• go test -race -shuffle=on ./... -timeout=120s
• go vet ./...
• golangci-lint v2.12.2 run ./... with repository .golangci.yml: 0 issues
• gofmt check and whitespace diff check
• go build -buildvcs=false ./cmd/coned (explicit flag needed for source snapshot; initial VCS auto-detection failed)
• govulncheck v1.9.0 ./...: no vulnerabilities found
• govulncheck v1.9.0 -scan=module from cmd/coned: no vulnerabilities found
• Independent review of exact three-file patch, unchanged module versions, and scan classifications

Linux/amd64 local validation only, not native macOS/Windows qualification or a release build. Scanner v1.9.0 is newer than the repository's CI-pinned v1.6.0; no CI configuration was changed. Hosted Actions were not enabled, rerun, or used as a gate. No live ConEd/provider calls or credential/keyring access; live test gate disabled.

[zzwong]

Reviewed exact head 53a56da against base 5a32a57. No blocking findings for this scoped patch.

The remote diff contains only the three intended Go 1.26.8 → 1.26.9 lines in go.mod, README.md, and DEVELOPMENT.md. Remote Git blob hashes match the locally tested candidate; go.sum is unchanged. Third-party versions, workflows, and the separate Dependabot/pagination work are untouched.

Reviewed local verification receipts: module verification, race/shuffle tests, vet, formatting, pinned golangci-lint v2.12.2, snapshot build with -buildvcs=false, and govulncheck v1.9.0 pass. Baseline Go 1.26.8 has nine symbol-level standard-library findings plus four uncalled findings; the Go 1.26.9 candidate reports no vulnerabilities. Symbol findings are not proof of practical exploitation.

Qualification is Linux/amd64 with synthetic tests. No native macOS/Windows, live-provider, release-build, or hosted-CI validation is claimed. The local scanner differs from the CI-pinned v1.6.0; CI settings were not changed. Existing release binaries still require rebuilding to receive the toolchain fixes.