fix(nexus): update Go runtime to 1.26.6

[plural-copilot]

Summary

• Update the Nexus Go module and its required shared Go workspace directive from Go 1.26.5 to Go 1.26.6.
• This is the minimal source remediation for the Nexus image (ghcr.io/pluralsh/nexus); no GitOps/image-tag changes or unrelated image definitions are included.

Confirmed image wiring

• .github/workflows/nexus-ci.yaml and .github/workflows/nexus-cd.yaml set REGISTRY_IMAGE=ghcr.io/pluralsh/nexus.
• Both build the image with context go/nexus and Dockerfile go/nexus/Dockerfile.
• go/nexus/Dockerfile already uses golang:1.26.6-alpine for the builder; the CI test/build jobs select Go from go/nexus/go.mod.
• go/go.work is the shared workspace directive enclosing Nexus. Updating it is required: Go rejects the Nexus module when its directive is newer than the workspace directive.

Files changed

• go/nexus/go.mod — set the Nexus CI/test/build toolchain directive to Go 1.26.6.
• go/go.work — set the shared workspace directive to Go 1.26.6 so Nexus module commands remain compatible.

Vulnerabilities remediated

The Go standard-library runtime upgrade remediates:

• CVE-2026-56862 (crypto/tls)
• CVE-2026-56860 (net/url)
• CVE-2026-56859 (encoding/xml)
• CVE-2026-56858 (html/template)
• CVE-2026-56853 (net/http)
• CVE-2026-46600 (DNS SVCB/HTTPS parsing)
• CVE-2026-39821 (IDNA/Punycode)

Validation

• Confirmed golang:1.26.6 and golang:1.26.6-alpine are available; verified go version go1.26.6 linux/amd64.
• Passed go test -race -count=1 ./... for go/nexus in a golang:1.26.6 container.
• Passed a local go/nexus/Dockerfile build tagged ghcr.io/pluralsh/nexus:validation-go1.26.6.
• Inspected the built image: Nexus OCI title/source labels, /app/nexus entrypoint, and non-root runtime user are present.
• Passed docker run --rm ghcr.io/pluralsh/nexus:validation-go1.26.6 --help and git diff --check.

Required follow-up

A new Nexus image must be built, published, and rescanned from this change before any separate GitOps image-tag bump. This PR intentionally does not change GitOps image tags.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one minimal source-remediation PR for the Nexus image vulnerability findings in mgmt/plrl-console....
🔗 Run history	View run history

[soffi-ai]

Soffi AI Summary

This PR upgrades the Go runtime directive for the Nexus module (go/nexus/go.mod) and the shared Go workspace (go/go.work) from Go 1.26.5 to Go 1.26.6. The primary motivation is security: the Go 1.26.6 standard library release remediates seven CVEs across crypto/tls, net/url, encoding/xml, html/template, net/http, DNS SVCB/HTTPS parsing, and IDNA/Punycode handling. The change is minimal and surgical — only the two directive lines are updated — ensuring the Nexus CI/CD pipeline builds the ghcr.io/pluralsh/nexus image with a patched runtime. A follow-up image publish and GitOps tag bump will be required separately before the fix reaches production clusters.

Changes

Go runtime upgrade to 1.26.6 for Nexus (CVE remediation)

• Bumps the Go toolchain directive in go/nexus/go.mod and the shared go/go.work workspace file from 1.26.5 to 1.26.6 to remediate seven Go standard-library CVEs (CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600, CVE-2026-39821). No other files or image tags are changed; a downstream image publish is required to deploy the fix. (b5426b2)

---

Updated: 2026-08-28 23:35 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

Updates the Nexus module and shared Go workspace directives from Go 1.26.5 to 1.26.6.

• Aligns Nexus CI and module commands with the patched Go runtime.
• Keeps the enclosing workspace directive compatible with the Nexus module.

Confidence Score: 5/5

The PR appears safe to merge because the module and workspace directives are consistently updated to the same Go patch release.

The two-line change preserves workspace compatibility, aligns Nexus builds with the existing Go 1.26.6 Docker builder, and introduces no dependency or application-code changes.

Important Files Changed

Filename	Overview
go/go.work	Updates the shared workspace Go directive to 1.26.6, keeping it aligned with the Nexus module.
go/nexus/go.mod	Updates the Nexus module Go directive to the patched 1.26.6 runtime without changing dependencies.

_{Reviews (1): Last reviewed commit: "fix(nexus): update Go runtime to 1.26.6" | Re-trigger Greptile}