fix(security): build with Go 1.26.10 for eMudhra intermediate distrust

AGENTS.md

@@ -64,7 +64,7 @@ go mod tidy && go mod vendor
 act -e testdata/act/pull-request.json
 ```
 
-Go version comes from `go.mod` (`go-version-file: go.mod` in CI). Current module requires **Go 1.25**.
+Go version comes from `go.mod` (`go-version-file: go.mod` in CI). The module targets `go 1.26.0` and pins the build toolchain with `toolchain go1.26.10`; keep the `golang:` builder image in the Dockerfile in sync.
 
 ## Changing behavior — required sync points
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.8-alpine AS builder
+FROM golang:1.26.10-alpine AS builder
 
 RUN apk add --no-cache git
 

go.mod

@@ -2,7 +2,7 @@ module github.com/launchdarkly/find-code-references-in-pull-request
 
 go 1.26.0
 
-toolchain go1.26.8
+toolchain go1.26.10
 
 require (
 	github.com/Masterminds/sprig/v3 v3.3.0