fix(deps): update golang:1.26.1-bookworm docker digest to 8e8aa80

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
golang	final	digest	c7a82e9 → 8e8aa80

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates the golang:1.26.1-bookworm Docker image digest from c7a82e9 to 8e8aa80. This is a digest-only update for the same semantic version (1.26.1), which indicates a rebuild of the base image.

Key Changes:

• Base Image Update: The golang:1.26.1-bookworm image has been rebuilt, likely incorporating recent Debian Bookworm security updates from March 2026
• Go Version: Remains at Go 1.26.1 (released March 5, 2026) - no change to the Go toolchain itself
• Security Context: Go 1.26.1 already includes security fixes for crypto/x509, html/template, net/url, and os packages
• Debian Security: Debian Bookworm received multiple security advisories in March 2026, including critical updates for Linux kernel (DSA-6162-1, DSA-6163-1), Chromium, and base system packages

Type of Update:

• This is a routine maintenance update that incorporates security patches from the underlying Debian Bookworm base image
• No API changes, no breaking changes, no behavioral modifications to Go 1.26.1 itself
• The digest change represents a layer rebuild with updated base image packages

🎯 Impact Scope Investigation

Direct Usage:

• The golang:1.26.1-bookworm image is used exclusively in the builder stage of the multi-stage Dockerfile (Dockerfile:78)
• Purpose: Compiles two Go binaries (gocacheprog and sandbox) from source
• The compiled binaries are static (CGO_ENABLED=0) and copied to the final image

Dependency Analysis:

• ✅ go.mod: Specifies go 1.26.0 as minimum version - fully compatible with Go 1.26.1
• ✅ mise.toml: Uses Go 1.26.1 for development tooling - exact match with builder image
• ✅ Runtime Go: The sandbox runtime uses Go 1.26.0 (installed via mise in base stage) - unaffected by builder image change
• ✅ Build Process: No changes to build flags, CGO settings, or compiler options required

CI/CD Status:

• ✅ Build: PASSED (23s)
• ✅ Unit Test: PASSED (25s)
• ✅ Lint: PASSED (29s)
• ✅ hadolint: PASSED (10s)
• ⏳ E2E Test (ubuntu-latest): PENDING
• ⏳ E2E Test (ubuntu-24.04-arm): PENDING

Impact Assessment:

• Zero code changes required: This is a build-time-only dependency for compilation
• No runtime impact: The final Docker image uses the base image with mise-installed Go 1.26.0
• Binary compatibility: Static binaries compiled with Go 1.26.1 are fully compatible with all Go 1.26.x deployments
• No configuration changes: All build arguments, environment variables, and paths remain unchanged

💡 Recommended Actions

Immediate Actions:

1. ✅ Merge after E2E tests pass - All critical checks have already passed; wait for E2E confirmation
2. ✅ No code modifications required - This is a transparent security update
3. ✅ No deployment risk - Static binary compilation ensures no runtime dependencies on builder image

Verification Steps:

• Monitor the pending E2E tests to confirm behavioral compatibility
• After merge, verify that the Docker build completes successfully in CI
• Confirm that compiled binaries maintain the same size and behavior

Optional Follow-up:

• Consider upgrading the mise-installed Go runtime from 1.26.0 to 1.26.1 in the base stage (Dockerfile:50) to align with the builder image version, though this is not required for this PR

Security Benefits:

• Incorporates latest Debian Bookworm security patches
• Reduces potential attack surface from outdated base image packages
• Maintains alignment with Docker official images security best practices

🔗 Reference Links

• Go Release History - Go 1.26.1
• Golang Docker Hub Official Image
• Docker Library Golang Repository
• Debian Bookworm Release Information
• Debian Security Advisories - March 2026

Generated by koki-develop/claude-renovate-review