Go toolchain 1.26.9 fails govulncheck on GO-2026-6809 (crypto/x509: distrust compromised intermediate certificates), a public Go standard-library advisory fixed in go1.26.10. govulncheck v1.7.0 reports it on every pull request's govulncheck job. Found on pull request 1107's govulncheck job, 2026-10-22. The external-contribution runbook's contained test image (.abcd/work/intake.md) also named go 1.26.7, two bumps behind go.mod, and moves with it.

Go toolchain 1.26.9 fails govulncheck on GO-2026-6809 (crypto/x509: distrust compromised intermediate certificates), a public Go standard-library advisory fixed in go1.26.10. govulncheck v1.7.0 reports it on every pull request's govulncheck job. Found on pull request 1107's govulncheck job, 2026-10-22. The external-contribution runbook's contained test image (.abcd/work/intake.md) also named go 1.26.7, two bumps behind go.mod, and moves with it.

Grounds

• pursued: a binary built from this tree carries the crypto/x509 fixed in go1.26.10; govulncheck reporting GO-2026-6809 on the next cut's binary would show it wrong