[MattGathman]

Why

Aqua flags the scuttle binary (Go 1.26.9 stdlib) in images that copy it from r1/analytics/scuttle:v1.3.36-rel (REL-1405360, r1/analytics/classification-job-c4-trigger):

• Go stdlib crypto/x509 (fixed in 1.26.10): CVE-2026-111943 (GO-2026-6809, "Distrust compromised intermediate certificates in crypto/x509")

golang.org/x/net v0.61.0 and golang.org/x/text v0.43.0 are already current; govulncheck reports nothing open against them.

What

• go.mod: go 1.26.10 (go mod tidy made no further changes; go.sum unchanged)
• Dockerfile: FROM golang:1.26.10-bookworm
• .github/workflows/relativity-ci.yml, .github/workflows/release.yaml: go-version: '1.26.10'

No code changes.

Verification

• go mod tidy, go build ./..., go vet ./... and go test -test.timeout 30s ./... pass in golang:1.26.10-bookworm (ok github.com/redboxllc/scuttle 18.326s).
• govulncheck ./... (v1.9.0, DB updated 2026-10-21): on main with Go 1.26.9 it reports GO-2026-6809 (crypto/x509@go1.26.9, fixed in go1.26.10); on this branch with Go 1.26.10, "No vulnerabilities found."
• Docker image built from this branch; the binary reports go1.26.10, golang.org/x/net v0.61.0, golang.org/x/text v0.43.0, and govulncheck -mode=binary finds no vulnerabilities.

🤖 Generated with Claude Code

[MattGathman]

Closing this draft. The repo is owned by Distributed Data Ops, so we won't push the Go bump here ourselves. For whoever picks it up: CVE-2026-111943 (GO-2026-6809, crypto/x509) is fixed in Go 1.26.10. govulncheck flags it on main (Go 1.26.9) and finds nothing after the one-line Go bump in go.mod, the Dockerfile and both workflows (same pattern as #63). The go-1.26.10 branch is left in place in case it's useful.