chore(deps): bump golang.org/x/crypto and build with Go 1.26.5

[leggetter]

Two changes that together clear every fixable vulnerability the CLI currently reports, ahead of the v2.4.0 release. Both matter because release.yml builds the binaries users install.

1. golang.org/x/crypto → v0.52.0

Clears all 13 open Dependabot alerts on the default branch. Every one is x/crypto, and every one is fixed in 0.52.0.

Severity	Count	CVEs
Critical	7	CVE-2026-39830, -39831, -39832, -39833, -39834, -42508, -46595
High	2	CVE-2026-39829, CVE-2026-46597
Moderate	4	CVE-2026-39827, -39828, -39835, -46598

Two lines in go.mod; x/text follows as a transitive requirement. go mod tidy is a no-op afterwards.

Exposure was limited — x/crypto is indirect and go mod why reports (main module does not need package golang.org/x/crypto); it comes via go-github, x/mod and x/net. The bump is free regardless.

2. CI toolchain 1.24.9 → 1.26.5

The pinned toolchain carried standard-library vulnerabilities that govulncheck finds reachable from this code — crypto/x509, crypto/tls, net/http, net/textproto. Since release.yml builds the published binaries, the pin decides what ships.

Verified on the same tree under both toolchains:

Toolchain	Affected
go1.26.1	10 vulnerabilities (1 module + standard library)
go1.26.5	1 vulnerability (1 module, no standard library)

12 pins across acceptance.yml, release.yml, test.yml and test-npm-build.yml. test-homebrew-build.yml already derives its version from go.mod and is untouched.

Worth noting the old pin was already misleading: go.mod declares go 1.25.0, above the pinned 1.24.9, so Go was auto-downloading a newer toolchain anyway.

What still isn't fixed

GO-2026-5932 — x/crypto/openpgp is unmaintained, "Fixed in: N/A", reached transitively via go-github through package init() (pkg/version/version.go → github.init → openpgp.init). No bump resolves it; it needs go-github to drop the dependency or that import removed. Not a Dependabot alert, so out of scope — worth its own issue.

Test plan

• go build ./... and go test ./... clean on both go1.26.1 and go1.26.5 — 14 packages
• go mod tidy is a no-op after the bump
• govulncheck under go1.26.5: 10 findings → 1, no standard-library findings left
• Toolchain installed locally and verified, not assumed from release notes

🤖 Generated with Claude Code

https://claude.ai/code/session_01HHJQ1QSdKmJMivqw7SER6t

[Copilot]

Pull request overview

This PR updates Go module dependencies and CI Go toolchain pins to reduce/clear reported vulnerabilities in the Hookdeck CLI build and release pipelines (notably release.yml, which produces the distributed binaries).

Changes:

• Bump indirect deps golang.org/x/crypto to v0.52.0 (and resulting go.sum updates, including transitive module versions).
• Update GitHub Actions workflows to build/test with Go 1.26.5 instead of 1.24.9.
• Refresh go.sum entries for updated module resolution (e.g., x/net, x/tools) as part of the dependency bump.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go.mod	Updates indirect module versions (x/crypto, x/text) to patched releases.
go.sum	Updates checksum entries to match the new dependency graph after the bump.
.github/workflows/test.yml	Pins all test/build jobs to Go 1.26.5.
.github/workflows/test-npm-build.yml	Pins the npm build verification workflow to Go 1.26.5.
.github/workflows/release.yml	Pins release build workflows to Go 1.26.5 (affects shipped binaries).
.github/workflows/acceptance.yml	Pins acceptance workflows to Go 1.26.5 (but still uses actions/setup-go@v3).

Suppressed comments (1)

.github/workflows/acceptance.yml:58

• Same as the main acceptance matrix job: this job is still on actions/setup-go@v3 while other workflows are on actions/setup-go@v5 (see .github/workflows/test.yml). With the Go version bump to 1.26.5, it’s better to keep the action version consistent across workflows.

      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: "1.26.5"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.