From 592a1e52f6c281cf7a45331d9b212121a19ddb55 Mon Sep 17 00:00:00 2001
From: rcourtman <8825017+rcourtman@users.noreply.github.com>
Date: Sun, 11 Oct 2026 22:37:46 +0100
Subject: [PATCH] Advance the Go toolchain to 1.26.9 and x/net to v0.60.0

govulncheck on the pinned 1.26.8 toolchain reports twelve reachable
standard library vulnerabilities in Pulse (net/http, crypto/tls,
html/template, os, net/textproto), published on 2026-10-08 and fixed in
Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in
v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting
vulnerabilities under both govulncheck v1.1.4 and v1.7.0.

Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged
this. The private Enterprise build and test job notices it: once the scan
finds reachable advisories it needs more than the 4 GiB CI VM holds, the
guest kernel kills govulncheck, and the job is cancelled. That has failed
every Enterprise pair check since 2026-10-08, including the first
beta's.

Move every release builder and local toolchain guard together, as 1.26.8
did, so no candidate artifact keeps an older compiler: go.mod, the
builder image digests (index digest for 1.26.9-alpine), the release and
dev scripts, the devcontainer, and the root pair diagnostic. Only x/net
is raised in the module graph; go mod tidy is deliberately not run, so
unrelated indirect requirements stay as they were.

Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
---
 .devcontainer/Dockerfile                       |  2 +-
 .devcontainer/README.md                        |  6 +++---
 .github/workflows/root-pair-diagnostic.yml     |  2 +-
 Dockerfile                                     |  2 +-
 deploy/provider-msp/Dockerfile.control-plane   |  2 +-
 docs/operations/root-pair-diagnostic.md        |  2 +-
 .../subsystems/deployment-installability.md    | 18 ++++++++++--------
 go.mod                                         |  4 ++--
 go.sum                                         |  2 ++
 scripts/.go-version                            |  2 +-
 scripts/build-release-binaries.sh              |  2 +-
 scripts/build-release.sh                       |  2 +-
 scripts/build-secure-runtime-qualification.sh  |  2 +-
 scripts/diagnose-root-pair.py                  |  4 ++--
 scripts/install-go-toolchain.sh                |  8 +++++---
 .../installtests/build_release_assets_test.go  |  6 +++---
 .../installtests/integration_container_test.go |  2 +-
 .../installtests/provider_msp_deploy_test.go   |  6 +++---
 scripts/tests/test-hot-dev-runtime.sh          |  6 +++---
 scripts/tests/test_root_pair_diagnostic.py     |  4 ++--
 .../integration/mock-github-server/Dockerfile  |  2 +-
 21 files changed, 46 insertions(+), 40 deletions(-)

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 18b4e57448..50ddfeaa4f 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.8@sha256:0f063af2d465d8dcae54cce04278ada488b96f77b42449c8d071e47d016cc65a
+FROM golang:1.26.9@sha256:d7722066f0b60ceccb6c0643cbed1f5f9e15506ac237146c95333504d7805d89
 
 # Set bash as default shell for features
 SHELL ["/bin/bash", "-c"]
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
index a569db1157..6649aae036 100644
--- a/.devcontainer/README.md
+++ b/.devcontainer/README.md
@@ -5,7 +5,7 @@ This dev container provides a complete, reproducible development environment for
 ## What's Included
 
 ### Development Tools
-- **Go 1.26.8** - Backend development
+- **Go 1.26.9** - Backend development
 - **Node.js 24** - Frontend development
 - **gopls v0.17.0** - Go language server
 - **Delve** - Go debugger
@@ -225,7 +225,7 @@ Custom overrides: Create `.env.devcontainer` (gitignored)
 ## Resources
 
 - **VM Specs**: 8GB RAM, 30GB disk, 2 CPU cores
-- **Base Image**: `golang:1.26.8` (Debian-based)
+- **Base Image**: `golang:1.26.9` (Debian-based)
 - **Caches**: ~2-3GB for Go modules and build artifacts
 
 ## Tips & Tricks
@@ -247,7 +247,7 @@ MacBook (VS Code)
 dev-containers VM (Proxmox)
     ↓ Docker
 Dev Container
-    ├── Go 1.26.8 + tools
+    ├── Go 1.26.9 + tools
     ├── Node 24 + npm
     ├── Your code (/workspaces/pulse)
     ├── Hot reload watchers
diff --git a/.github/workflows/root-pair-diagnostic.yml b/.github/workflows/root-pair-diagnostic.yml
index 5fd3aeb47b..5e52b49d6f 100644
--- a/.github/workflows/root-pair-diagnostic.yml
+++ b/.github/workflows/root-pair-diagnostic.yml
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26.8'
+          go-version: '1.26.9'
           cache: false
       - name: Collect fixed exact-pair root evidence
         run: python3 scripts/diagnose-root-pair.py --output root-pair-evidence
diff --git a/Dockerfile b/Dockerfile
index f072701ddd..1e4e2b40a8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,7 +26,7 @@ RUN --mount=type=cache,id=pulse-npm-cache,target=/root/.npm \
 # Build stage for Go backend
 # Force amd64 platform - Go cross-compiles for all targets anyway,
 # and this avoids slow QEMU emulation during multi-arch builds
-FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:51a7c389a5ddaf82f527191a1e9bff9928655130a44e4975dd1d7e0acf59f1ae AS backend-builder
+FROM --platform=linux/amd64 golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS backend-builder
 
 ARG BUILD_AGENT
 ARG VERSION
diff --git a/deploy/provider-msp/Dockerfile.control-plane b/deploy/provider-msp/Dockerfile.control-plane
index 3049e143e8..f2f65fc6d9 100644
--- a/deploy/provider-msp/Dockerfile.control-plane
+++ b/deploy/provider-msp/Dockerfile.control-plane
@@ -12,7 +12,7 @@ COPY SECURITY.md TERMS.md /app/
 RUN --mount=type=cache,id=pulse-control-plane-npm-cache,target=/root/.npm \
     npm run build
 
-FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder
 ARG VERSION=dev
 ARG BUILD_TIME=unknown
 ARG GIT_COMMIT=unknown
diff --git a/docs/operations/root-pair-diagnostic.md b/docs/operations/root-pair-diagnostic.md
index 2a33515911..944f067634 100644
--- a/docs/operations/root-pair-diagnostic.md
+++ b/docs/operations/root-pair-diagnostic.md
@@ -10,7 +10,7 @@ The source pair is fixed in `scripts/diagnose-root-pair.py`: baseline
 `1120cce4d631bca5525cafc5b5620251998773f7` tree measured from ephemeral
 source commit `4cdf250f474ad9cde6ffb121527f021b7387603f7`; metadata retains that original
 evidence identity. Tree and HTTP source hashes must match. Both API test binaries
-use Go 1.26.8, readonly modules and identical CI
+use Go 1.26.9, readonly modules and identical CI
 embed text; compilation finishes before either warm-up. Four available CPUs
 are selected and inherited by children, GOMAXPROCS is four. After two 100ms
 warm-ups and ten seconds settling, ten rounds alternate AB/BA with one 1s
diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md
index 70eda1305e..198639dee0 100644
--- a/docs/release-control/v6/internal/subsystems/deployment-installability.md
+++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md
@@ -4779,18 +4779,20 @@ governed release toolchain and immutable Go builder digest together, not to
 suppress the scanner or produce release artifacts with an older patched-over
 runtime.
 The hosted control-plane source builder and integration mock builder are both
-on the reviewed `golang:1.26.8-alpine` digest
-`sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c`.
+on the reviewed `golang:1.26.9-alpine` digest
+`sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade`.
 `TestProviderMSPGoBuilderMatchesIntegrationMock` pins their exact agreement;
 it does not pull the image, prove its registry contents, or qualify a deployed
 control plane. The release publisher's prebuilt control-plane target is a
 separate path and does not rebuild its binary from this stage.
-As of 2026-08-27, the governed release floor is Go `1.26.7`. It supersedes
-`1.26.5`, whose standard library is reachable through seven vulnerable Pulse
-call paths reported by `govulncheck`, including HTTP/TLS, URL parsing, SAML XML
-decoding, HTML templating, and public-key parsing. Both source-built container
-stages pin the Docker Official Images Linux amd64 manifest
-`sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468`;
+As of 2026-10-11, the governed release floor is Go `1.26.9`. It supersedes
+`1.26.8`, whose standard library is reachable through twelve vulnerable Pulse
+call paths reported by `govulncheck` after the 2026-10-08 advisories, including
+`net/http`, `crypto/tls`, `html/template`, `os`, and `net/textproto`. The
+`golang.org/x/net` floor is `v0.60.0` for the same advisories. Source-built
+container stages pin the Docker Official Images manifest list for
+`golang:1.26.9-alpine`,
+`sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade`;
 the checked-in toolchain files and release-script guards must reject an older
 compiler so local, exact-candidate, provider control-plane, and container builds
 cannot silently reintroduce the vulnerable runtime.
diff --git a/go.mod b/go.mod
index 67ab88bf3e..a8953338a4 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/rcourtman/pulse-go-rewrite
 
 go 1.26.0
 
-toolchain go1.26.8
+toolchain go1.26.9
 
 require (
 	github.com/IGLOU-EU/go-wildcard/v2 v2.1.1
@@ -107,7 +107,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
diff --git a/go.sum b/go.sum
index 339b6372cb..1ab3f4036a 100644
--- a/go.sum
+++ b/go.sum
@@ -288,6 +288,8 @@ golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
 golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
diff --git a/scripts/.go-version b/scripts/.go-version
index 69a767031f..cf88115cf1 100644
--- a/scripts/.go-version
+++ b/scripts/.go-version
@@ -1 +1 @@
-go1.26.8
+go1.26.9
diff --git a/scripts/build-release-binaries.sh b/scripts/build-release-binaries.sh
index 6218b98080..2b1fb23eb0 100755
--- a/scripts/build-release-binaries.sh
+++ b/scripts/build-release-binaries.sh
@@ -44,7 +44,7 @@ case "${OUTPUT_ROOT}" in
         ;;
 esac
 
-required_go="go1.26.8"
+required_go="go1.26.9"
 current_go="$(go env GOVERSION 2>/dev/null || true)"
 if [[ "${current_go}" != "${required_go}" ]]; then
     echo "Error: Go toolchain must be ${required_go} (got ${current_go:-unknown})." >&2
diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index e88c5bc0f1..3735e83f79 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -20,7 +20,7 @@ if [ -x /usr/local/go/bin/go ]; then
 fi
 
 # Release artifacts must be built with the vetted toolchain to match security-gate evidence.
-required_go="go1.26.8"
+required_go="go1.26.9"
 current_go="$(go env GOVERSION 2>/dev/null || true)"
 if [[ "${PULSE_SKIP_GO_VERSION_CHECK:-false}" != "true" ]]; then
     if [[ "${current_go}" != "${required_go}" ]]; then
diff --git a/scripts/build-secure-runtime-qualification.sh b/scripts/build-secure-runtime-qualification.sh
index 7ce60a1bf9..58b9d80fc7 100755
--- a/scripts/build-secure-runtime-qualification.sh
+++ b/scripts/build-secure-runtime-qualification.sh
@@ -35,7 +35,7 @@ if [[ -z "${PULSE_UPDATE_SIGNING_PUBLIC_KEY:-}" ]]; then
     exit 3
 fi
 
-required_go="go1.26.8"
+required_go="go1.26.9"
 go_version="$(go env GOVERSION 2>/dev/null || true)"
 if [[ "${go_version}" != "${required_go}" ]]; then
     echo "Error: Go toolchain must be ${required_go} (got ${go_version:-unknown})." >&2
diff --git a/scripts/diagnose-root-pair.py b/scripts/diagnose-root-pair.py
index a951b0b465..fefc59989f 100644
--- a/scripts/diagnose-root-pair.py
+++ b/scripts/diagnose-root-pair.py
@@ -71,8 +71,8 @@ def telemetry():
 def execute(repo, output):
     output.mkdir(parents=True, exist_ok=False)  # never overwrite a previous attempt
     os.environ.update(GOTOOLCHAIN='local', GOMAXPROCS='4', GOFLAGS='-mod=readonly', GOENV='off', GOAMD64='v1', CGO_ENABLED='1')
-    if run(['go', 'version']).strip() != 'go version go1.26.8 linux/amd64':
-        raise ValueError('requires exact hosted experiment toolchain go1.26.8 linux/amd64')
+    if run(['go', 'version']).strip() != 'go version go1.26.9 linux/amd64':
+        raise ValueError('requires exact hosted experiment toolchain go1.26.9 linux/amd64')
     metadata = {
         'purpose': 'diagnostic-only; no gate disposition or release candidate',
         'rounds': ROUNDS, 'gomaxprocs': 4, 'benchtime': '1s',
diff --git a/scripts/install-go-toolchain.sh b/scripts/install-go-toolchain.sh
index 9d79bcec12..ddbbc9fb90 100755
--- a/scripts/install-go-toolchain.sh
+++ b/scripts/install-go-toolchain.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 VERSION_FILE="${SCRIPT_DIR}/.go-version"
-DEFAULT_VERSION="go1.26.8"
+DEFAULT_VERSION="go1.26.9"
 TARGET_ROOT="/opt/toolchains/go"
 DOWNLOAD_ROOT="https://dl.google.com/go"
 GOPATH_DIR="/var/lib/pulse/go"
@@ -14,7 +14,8 @@ if [[ ! -f "$VERSION_FILE" ]]; then
   echo "$DEFAULT_VERSION" | sudo tee "$VERSION_FILE" >/dev/null
 fi
 VERSION="$(tr -d '
-
' < "$VERSION_FILE")"
+
+' < "$VERSION_FILE")"
 ARCHIVE="${VERSION}.linux-amd64.tar.gz"
 DOWNLOAD_DIR="${TMPDIR:-/tmp}/go-install"
 ARCHIVE_PATH="$DOWNLOAD_DIR/$ARCHIVE"
@@ -28,7 +29,8 @@ fi
 curl -fsSL "$DOWNLOAD_ROOT/$ARCHIVE.sha256" -o "$SHA_PATH"
 
 CHECKSUM="$(tr -d '
-
' < "$SHA_PATH")"
+
+' < "$SHA_PATH")"
 printf '%s  %s
 ' "$CHECKSUM" "$ARCHIVE_PATH" | sha256sum -c -
 
diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go
index bb891d848c..061c862164 100644
--- a/scripts/installtests/build_release_assets_test.go
+++ b/scripts/installtests/build_release_assets_test.go
@@ -1618,7 +1618,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
 	dockerfile := string(dockerfileBytes)
 	dockerRequired := []string{
 		"FROM --platform=linux/amd64 node:24-alpine@sha256:" + node24Amd64FrontendDigest + " AS frontend-builder",
-		`FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:`,
+		`FROM --platform=linux/amd64 golang:1.26.9-alpine@sha256:`,
 		`FROM backend-builder AS release-assets-builder`,
 		`AS agent_runtime`,
 		`AS pulse-runtime-foundation`,
@@ -1653,7 +1653,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
 		}
 	}
 	assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 node:24-alpine@sha256:`, ` AS frontend-builder`)
-	assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:`, ` AS backend-builder`)
+	assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 golang:1.26.9-alpine@sha256:`, ` AS backend-builder`)
 	assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ` AS agent_runtime`)
 	assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ` AS pulse-runtime-foundation`)
 	hostedStart := strings.Index(dockerfile, `FROM pulse-runtime-base AS hosted_runtime`)
@@ -1666,7 +1666,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
 		t.Fatalf("hosted_runtime target must not depend on installer rendering or embedded agent artifacts:\n%s", hostedStage)
 	}
 	if strings.Contains(dockerfile, `FROM --platform=linux/amd64 node:24-alpine AS frontend-builder`) ||
-		strings.Contains(dockerfile, `FROM --platform=linux/amd64 golang:1.26.8-alpine AS backend-builder`) ||
+		strings.Contains(dockerfile, `FROM --platform=linux/amd64 golang:1.26.9-alpine AS backend-builder`) ||
 		strings.Contains(dockerfile, `FROM alpine:3.24 AS agent_runtime`) ||
 		strings.Contains(dockerfile, `FROM alpine:3.24 AS pulse-runtime-base`) {
 		t.Fatal("Dockerfile base images must be pinned by immutable @sha256 digests")
diff --git a/scripts/installtests/integration_container_test.go b/scripts/installtests/integration_container_test.go
index 094f01dcd1..437ec9be88 100644
--- a/scripts/installtests/integration_container_test.go
+++ b/scripts/installtests/integration_container_test.go
@@ -13,7 +13,7 @@ func TestIntegrationContainersUseGovernedImmutableBases(t *testing.T) {
 		t.Fatalf("read mock GitHub Dockerfile: %v", err)
 	}
 	dockerfile := string(dockerfileBytes)
-	assertDigestPinnedDockerStage(t, dockerfile, `FROM golang:1.26.8-alpine@sha256:`, ` AS builder`)
+	assertDigestPinnedDockerStage(t, dockerfile, `FROM golang:1.26.9-alpine@sha256:`, ` AS builder`)
 	assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ``)
 
 	composeBytes, err := os.ReadFile(repoFile("tests", "integration", "docker-compose.test.yml"))
diff --git a/scripts/installtests/provider_msp_deploy_test.go b/scripts/installtests/provider_msp_deploy_test.go
index 54f0659c93..7bdf067a9f 100644
--- a/scripts/installtests/provider_msp_deploy_test.go
+++ b/scripts/installtests/provider_msp_deploy_test.go
@@ -15,7 +15,7 @@ func TestProviderMSPGoBuilderMatchesIntegrationMock(t *testing.T) {
 	// These builders use the same Go patch level and immutable image. The
 	// mock's build must not exercise a different compiler from the hosted
 	// control plane merely because Dependabot advanced one Dockerfile.
-	const expected = "golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
+	const expected = "golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade"
 	pattern := regexp.MustCompile(`(?m)^FROM (?:--platform=\$BUILDPLATFORM )?(golang:[^[:space:]]+) AS builder$`)
 	for _, path := range [][]string{
 		{"deploy", "provider-msp", "Dockerfile.control-plane"},
@@ -328,7 +328,7 @@ func TestProviderMSPControlPlaneDockerfileBuildsReleaseLicenseBinary(t *testing.
 		"FROM --platform=linux/amd64 node:24-alpine@sha256:"+node24Amd64FrontendDigest+" AS frontend-builder",
 		"npm ci",
 		"npm run build",
-		"FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:",
+		"FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:",
 		"FROM alpine:3.24@sha256:",
 		"ARG PULSE_LICENSE_PUBLIC_KEY_SHA256",
 		"ARG TARGETOS",
@@ -355,7 +355,7 @@ func TestProviderMSPControlPlaneDockerfileBuildsReleaseLicenseBinary(t *testing.
 		"CGO_ENABLED=0 go build -o /pulse-control-plane ./cmd/pulse-control-plane",
 	)
 	assertDigestPinnedDockerStage(t, text, `FROM --platform=linux/amd64 node:24-alpine@sha256:`, ` AS frontend-builder`)
-	assertDigestPinnedDockerStage(t, text, `FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:`, ` AS builder`)
+	assertDigestPinnedDockerStage(t, text, `FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:`, ` AS builder`)
 	assertDigestPinnedDockerStage(t, text, `FROM alpine:3.24@sha256:`, ` AS control-plane-runtime-foundation`)
 }
 
diff --git a/scripts/tests/test-hot-dev-runtime.sh b/scripts/tests/test-hot-dev-runtime.sh
index f3b2b548a2..5c1c15995a 100755
--- a/scripts/tests/test-hot-dev-runtime.sh
+++ b/scripts/tests/test-hot-dev-runtime.sh
@@ -414,9 +414,9 @@ test_go_release_toolchain_floor() {
   module_toolchain="$(sed -n 's/^toolchain //p' "${ROOT_DIR}/go.mod")"
   installed_toolchain="$(cd "${ROOT_DIR}" && go env GOVERSION)"
 
-  assert_contains "Go module uses the patched release toolchain" "${module_toolchain}" "go1.26.8"
-  assert_contains "dev toolchain installer uses the patched release toolchain" "$(<"${ROOT_DIR}/scripts/.go-version")" "go1.26.8"
-  assert_contains "active dev runtime resolves the patched release toolchain" "${installed_toolchain}" "go1.26.8"
+  assert_contains "Go module uses the patched release toolchain" "${module_toolchain}" "go1.26.9"
+  assert_contains "dev toolchain installer uses the patched release toolchain" "$(<"${ROOT_DIR}/scripts/.go-version")" "go1.26.9"
+  assert_contains "active dev runtime resolves the patched release toolchain" "${installed_toolchain}" "go1.26.9"
 }
 
 test_backend_race_suite_keeps_hosted_runner_timeout_headroom() {
diff --git a/scripts/tests/test_root_pair_diagnostic.py b/scripts/tests/test_root_pair_diagnostic.py
index 84a41e9634..fd3434f585 100644
--- a/scripts/tests/test_root_pair_diagnostic.py
+++ b/scripts/tests/test_root_pair_diagnostic.py
@@ -56,7 +56,7 @@ class DiagnosticTests(unittest.TestCase):
 
         def fake_run(args, cwd=None):
             if args == ['go', 'version']:
-                return 'go version go1.26.7 linux/amd64' if bad_go else 'go version go1.26.8 linux/amd64'
+                return 'go version go1.26.7 linux/amd64' if bad_go else 'go version go1.26.9 linux/amd64'
             if args[:2] == ['git', 'rev-parse']:
                 return 'wrong' if bad_tree else diag.TREES[args[2].split('^')[0]]
             if args[:3] == ['go', 'tool', 'nm']:
@@ -151,7 +151,7 @@ class DiagnosticTests(unittest.TestCase):
         self.assertIn('[[ "$GITHUB_RUN_ATTEMPT" == 1 ]]', workflow)
         self.assertIn('path: root-pair-evidence/', workflow)
         self.assertIn('if: always()', workflow)
-        self.assertIn("go-version: '1.26.8'", workflow)
+        self.assertIn("go-version: '1.26.9'", workflow)
         self.assertIn('timeout-minutes: 45', workflow)
 
 
diff --git a/tests/integration/mock-github-server/Dockerfile b/tests/integration/mock-github-server/Dockerfile
index af4acf0871..3706d55115 100644
--- a/tests/integration/mock-github-server/Dockerfile
+++ b/tests/integration/mock-github-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c AS builder
+FROM golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade AS builder
 
 WORKDIR /build
 COPY go.mod ./