Update go to 1.26.5

[lucasmrod]

Resolves #48988.

I ran make update-go version=1.26.5.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.

Testing

• QA'd all new/changed functionality manually

Fleet:

fleetctl:

fleetctl --version
fleetctl - version orbit-v1.57.0-402-ge3d0c005dc
  branch:       48988-update-go-1.26.5
  revision:     e3d0c005dc6698c024ad47a124c99e4f264855a0
  build date:   2026-07-09
  build user:   lucas
  go version:   go1.26.5

Also verified orbit in Linux:

fleetd/orbit/Fleet Desktop

• Verified compatibility with the latest released version of Fleet (see Must rule)
• Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

Summary by CodeRabbit

• Chores

  • Updated the project and all included tooling modules to Go 1.26.5.
  • Refreshed build images used by desktop Linux, load testing, and related utilities to the newer Go toolchain.
  • Updated change log entries to reflect the Go version bump.

• Bug Fixes

  • Improved the automation that refreshes Go-pinned Docker image references to resolve and apply correct digests, helping prevent broken build images.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Updates Fleet’s pinned Go toolchain version to 1.26.5 across the main module, supporting tool modules, and Docker builder images, aligning with the goal in #48988. It also enhances make update-go to automatically resolve and pin Docker image digests (but currently uses a likely-wrong buildx imagetools inspect template field).

Changes:

• Bumped go directives in the root module and multiple tools/ + third_party/ modules to go 1.26.5.
• Updated Golang builder image tags + digests in relevant Dockerfiles to 1.26.5.
• Updated the update-go Makefile target to automatically resolve and rewrite image digests, and added an Orbit changelog entry for the bump.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
go.mod	Bump root module Go directive to 1.26.5.
Dockerfile-desktop-linux	Update Golang builder image to 1.26.5 with new pinned digest.
infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile	Update Golang builder image to 1.26.5 with new pinned digest.
tools/mdm/migration/mdmproxy/Dockerfile	Update Golang builder image to 1.26.5 with new pinned digest.
Makefile	Expand update-go scope and add digest auto-resolution logic.
third_party/vuln-check/go.mod	Bump Go directive to 1.26.5.
third_party/goval-dictionary/go.mod	Bump Go directive to 1.26.5.
tools/ci/apiparamcheck/go.mod	Bump Go directive to 1.26.5.
tools/ci/setboolcheck/go.mod	Bump Go directive to 1.26.5.
tools/github-manage/go.mod	Bump Go directive to 1.26.5.
tools/qacheck/go.mod	Bump Go directive to 1.26.5.
tools/snapshot/go.mod	Bump Go directive to 1.26.5.
tools/terraform/go.mod	Bump Go directive to 1.26.5.
tools/mdm/windows/bitlocker/go.mod	Bump Go directive to 1.26.5.
tools/fleet-mcp/go.mod	Bump Go directive to 1.26.5.
tools/dibble/go.mod	Bump Go directive to 1.26.5.
tools/screencap/go.mod	Bump Go directive to 1.26.5.
tools/hangar/go.mod	Bump Go directive to 1.26.5.
orbit/changes/update-go-1.26.5	Add Orbit changelog entry for the Go bump.
changes/update-go-1.26.5	Changelog entry for the bump (content excluded from review).

Files excluded by content exclusion policy (1)

• changes/update-go-1.26.5

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.11%. Comparing base (f24af18) to head (e3d0c00).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #48993      +/-   ##
==========================================
- Coverage   68.11%   68.11%   -0.01%     
==========================================
  Files        3730     3730              
  Lines      235229   235426     +197     
  Branches    12332    12332              
==========================================
+ Hits       160236   160360     +124     
- Misses      60618    60673      +55     
- Partials    14375    14393      +18     

Flag	Coverage Δ
backend	69.73% <ø> (-0.01%)	⬇️
backend-activity	85.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Walkthrough

This PR updates Go version references to 1.26.5 across the root module, selected third-party and tools modules, Docker builder images, Makefile update automation, and changelog entries. It also expands the Makefile’s managed go.mod list and changes the Dockerfile update flow to resolve and pin golang image digests automatically.

Possibly related issues

• Update Go to 1.26.5 in fleetd #48989: Shares the Go 1.26.5 toolchain bump across module files, Dockerfiles, and build references.

Possibly related PRs

• fleetdm/fleet#47158: Both PRs are toolchain-only updates that touch the root go.mod, multiple tools/*/third_party/* go.mod files, and Docker builder base images.
• fleetdm/fleet#48822: Both PRs modify overlapping tools/*/go.mod files and related Makefile-managed module lists.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR updates the Go directive, targeted Dockerfiles, supporting go.mod files, changelog entries, and Go pinning as requested.
Out of Scope Changes check	✅ Passed	The extra Makefile and supporting module updates still fit the repo-wide Go 1.26.5 toolchain bump.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: bumping Go to 1.26.5.
Description check	✅ Passed	The description includes the issue reference, change note, changes-file checkbox, testing, and relevant fleetd/orbit checklist items.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 48988-update-go-1.26.5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

Makefile (1)

1053-1067: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add the missing module files to UPDATE_GO_MODS. docs/go.mod, handbook/go.mod, and website/go.mod are present in the repo but not included here, so make update-go won’t bump their Go version.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` around lines 1053 - 1067, Add the missing module manifests to
UPDATE_GO_MODS in the Makefile so `make update-go` updates every tracked Go
module; include `docs/go.mod`, `handbook/go.mod`, and `website/go.mod` alongside
the existing entries in the UPDATE_GO_MODS list. Keep the change limited to the
module list definition so the update workflow covers all repo modules
consistently.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@Makefile`:
- Around line 1053-1067: Add the missing module manifests to UPDATE_GO_MODS in
the Makefile so `make update-go` updates every tracked Go module; include
`docs/go.mod`, `handbook/go.mod`, and `website/go.mod` alongside the existing
entries in the UPDATE_GO_MODS list. Keep the change limited to the module list
definition so the update workflow covers all repo modules consistently.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4f74754a-663e-4cea-a037-7be0f25c35ad

📥 Commits

Reviewing files that changed from the base of the PR and between 0a3d73a and a0f68ed.

📒 Files selected for processing (20)

• Dockerfile-desktop-linux
• Makefile
• changes/update-go-1.26.5
• go.mod
• infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile
• orbit/changes/update-go-1.26.5
• third_party/goval-dictionary/go.mod
• third_party/vuln-check/go.mod
• tools/ci/apiparamcheck/go.mod
• tools/ci/setboolcheck/go.mod
• tools/dibble/go.mod
• tools/fleet-mcp/go.mod
• tools/github-manage/go.mod
• tools/hangar/go.mod
• tools/mdm/migration/mdmproxy/Dockerfile
• tools/mdm/windows/bitlocker/go.mod
• tools/qacheck/go.mod
• tools/screencap/go.mod
• tools/snapshot/go.mod
• tools/terraform/go.mod