ROX-36083: Bump Go 1.26.5 and dependencies (master)

[janisz]

Summary

Bump Go from 1.26.3 to 1.26.5 and update golang.org/x/text, google.golang.org/grpc, klauspost/compress to fix FedRAMP GovCloud CVEs (ROX-36081, ROX-36083).

CVEs fixed:

• CVE-2026-42504, CVE-2026-27145, CVE-2026-39822 (Go stdlib)
• CVE-2026-56852 (golang.org/x/text)
• GHSA-hrxh-6v49-42gf (google.golang.org/grpc)
• GHSA-259r-337f-4rfw (klauspost/compress)

Note: golang.org/x/net was already at 0.56.0 on master (CVE-2026-46600 already fixed).

Partially generated by AI.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated the application’s underlying runtime and supporting libraries.
  • Includes maintenance updates to networking, compression, synchronization, and text-processing components.
  • No user-facing features or behavioral changes were introduced.

Walkthrough

The module Go version changed from 1.26.3 to 1.26.5. Several direct and indirect dependency versions also changed in go.mod.

Changes

Go module updates

Layer / File(s)	Summary
Module and dependency version updates go.mod	The Go version requirement changed to 1.26.5. The google.golang.org/grpc, github.com/klauspost/compress, golang.org/x/sync, and golang.org/x/text versions were updated. golang.org/x/term was unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: bradlugo

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the Go version and dependency updates, which match the main changeset.
Description check	✅ Passed	The description directly explains the Go and dependency updates and their purpose of addressing listed CVEs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-deps-fedramp-master

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

/retest scanner-db-on-push

[openshift-ci]

@github-actions[bot]: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

Details

In response to this:

/retest scanner-db-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.