main pins go 1.26.7 in go.mod, and govulncheck fails the merge queue (merge_group run 37897679940) on twelve stdlib advisories fixed in go1.26.9, among them GO-2026-6599 and GO-2026-6600 (html/template, reached through the dashboard page handler) and net/http traces.

main pins go 1.26.7 in go.mod, and govulncheck fails the merge queue (merge_group run 37897679940) on twelve stdlib advisories fixed in go1.26.9, among them GO-2026-6599 and GO-2026-6600 (html/template, reached through the dashboard page handler) and net/http traces.

Verified 2026-10-09 with GOTOOLCHAIN=go1.26.7 go run golang.org/x/vuln/cmd/govulncheck@latest ./... at main 7549ca2d5: GO-2026-6617, -6613, -6612, -6611, -6610, -6605 and -6603 (net/http), GO-2026-6608 (net/textproto), GO-2026-6607 (crypto/tls), GO-2026-6604 (os), GO-2026-6600 and GO-2026-6599 (html/template, trace internal/surface/dashboard/server.go:274 dashboard.servePage calls template.Template.Execute), each fixed in go1.26.9.