Security: bump Go to >= 1.26.5 to address CVE-2026-39822

[acquia-patchbot]

Summary

CVE-2026-39822 (MEDIUM, CVSS 4.4) affects the temporal CLI binary in the current release (v1.8.2, go 1.26.4):

CVE-2026-39822 — Go os.Root on Unix improperly follows symlinks outside root when path ends with / and final component is a symlink. Allows local directory traversal. Patched in Go 1.26.5.

Request

Please bump the go directive in go.mod to >= 1.26.5 and cut a new release.

References:

• https://pkg.go.dev/vuln/GO-2026-4970
• https://nvd.nist.gov/vuln/detail/CVE-2026-39822