[jeremy]

GO-2026-6859 in the standard library's net/http is fixed in go1.26.11.
The govulncheck job runs on stable, but the test and release jobs read
go.mod, so released binaries were built on 1.26.9. Bring .mise.toml,
which had drifted to 1.26.6, up to match.

Verified locally on go1.26.11: build, vet, go test ./... and govulncheck v1.8.0 pass (no reachable vulnerabilities).

---

Summary by cubic

Upgrades the Go toolchain to 1.26.11 to fix GO-2026-6859 in the standard library's net/http package.

• Released binaries were built with Go 1.26.9, and .mise.toml had drifted further behind at 1.26.6.
• Bumps go.mod to go 1.26.11 and .mise.toml to match, so test and release jobs build with the fixed toolchain.
• Verified locally on go1.26.11: build, vet, go test ./..., and govulncheck v1.8.0 pass with no reachable vulnerabilities.

^{Written for commit 67ec33a. Summary will update on new commits.}

Confidence Score: 5/5

This PR appears safe to merge.

Summary

Updates the Go build requirement to 1.26.11.

• Local and release builds now use Go 1.26.11.

_{Reviews (1) · Last reviewed commit: "Build with Go 1.26.11 for net/http's GO-..." · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[Copilot]

🟢 Approved

No active review issues are reported for the Go 1.26.11 toolchain update.

No open issues 🎉

What changed in this PR

Updates the CLI’s Go toolchain to 1.26.11 to address the reported net/http vulnerability GO-2026-6859 and align development, test, and release builds.

Changes:

• Raises the Go version in go.mod from 1.26.9 to 1.26.11.
• Updates .mise.toml from 1.26.6 to the same version.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
go.mod	Sets Go 1.26.11 for builds, including test and release jobs.
.mise.toml	Aligns the local Go toolchain with go.mod.

_{Review effort: Balanced}