Upgrade Go toolchain to 1.26.1 to fix stdlib CVEs

Addresses GO-2026-4601 (net/url IPv6 parsing), GO-2026-4602 (os.Root
FileInfo escape), GO-2026-4599 and GO-2026-4600 (crypto/x509), all fixed
in go1.26.1. Updates CI workflows from go1.24 to go1.26 accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jingle2008

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.26"
       - name: Setup dev tools
         run: make setup
       - name: Lint, test, coverage threshold
@@ -38,7 +38,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.26"
       - name: Setup dev tools
         run: make setup
       - name: Lint, test, coverage threshold

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.26"
       - name: Setup dev tools
         run: make setup
       - name: Run tests

go.mod

@@ -1,16 +1,13 @@
 module github.com/jingle2008/toolkit
 
-go 1.24.0
-
-toolchain go1.24.13
+go 1.26.1
 
 require (
 	github.com/atotto/clipboard v0.1.4
 	github.com/charmbracelet/bubbles v0.21.0
 	github.com/charmbracelet/bubbletea v1.3.4
 	github.com/charmbracelet/glamour v0.9.1
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/go-viper/mapstructure/v2 v2.4.0
 	github.com/golangci/golangci-lint/v2 v2.3.1
 	github.com/hashicorp/hcl/v2 v2.20.1
 	github.com/mattn/go-runewidth v0.0.16
@@ -112,6 +109,7 @@ require (
 	github.com/go-toolsmith/astp v1.1.0 // indirect
 	github.com/go-toolsmith/strparse v1.1.0 // indirect
 	github.com/go-toolsmith/typep v1.1.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect