fix(ci): bump Go to 1.26.10 for GO-2026-6809

CHANGELOG.md

@@ -43,6 +43,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Security
 
+- Bump Go to 1.26.10 to pick up the fix for GO-2026-6809 (crypto/x509), which `govulncheck` now reports against 1.26.9.
 - A small `CUDLY_MCP_MAX_COUNT` no longer admits an enormous purchase (50 x
   `u-24tb1` is about $286M): the USD cap bounds the real total.
 

CONTRIBUTING.md

@@ -48,7 +48,7 @@ By participating in this project, you agree to maintain a respectful and inclusi
 
 ### Prerequisites
 
-- Go 1.26.9 or later (the floor set by the `go` directive in `go.mod`)
+- Go 1.26.10 or later (the floor set by the `go` directive in `go.mod`)
 - Git
 
 ### Getting Started
@@ -85,7 +85,7 @@ from a copy of the committed `go.work` and append your active worktrees:
 // go.work.local -- gitignored, developer-local
 // Keep this `go` line at or above the modules' own directive, otherwise the
 // workspace is rejected. Copy it from the committed go.work.
-go 1.26.9
+go 1.26.10
 
 use (
     .

README.md

@@ -6,7 +6,7 @@ Every purchase tool is dry-run by default (`dry_run=true`) and requires an expli
 
 ## Install
 
-Use Go 1.26.9, as declared by this module. The shared Go modules are published and pinned in `go.mod`, so this checkout builds on its own. From this checkout:
+Use Go 1.26.10, as declared by this module. The shared Go modules are published and pinned in `go.mod`, so this checkout builds on its own. From this checkout:
 
 ```bash
 make build

go.mod

@@ -1,6 +1,6 @@
 module github.com/LeanerCloud/cloud-commitments-mcp
 
-go 1.26.9
+go 1.26.10
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.47.3

go.work

@@ -1,3 +1,3 @@
-go 1.26.9
+go 1.26.10
 
 use .