Fix all Snyk go.mod vulnerabilities: Go toolchain 1.26.7 + mapstructure v2.4.0

[devin-ai-integration]

Closes: n/a (Snyk remediation)

Removes every open-source vulnerability Snyk reports for go.mod. No source code changes.

What changed

• go.mod: go 1.23.7 → go 1.26.7. Nearly all findings were Go standard library CVEs attributed to the Go version Snyk reads from go.mod (std/net/http, std/net/url, std/net, std/crypto/x509, std/os, std/mime, std/os/exec, std/syscall, std/html/template). The highest fix threshold across the reported issues was 1.25.13 / 1.26.6, so 1.26.7 (current patch of a supported release line) clears all of them.
• go.mod/go.sum: github.com/go-viper/mapstructure/v2 2.3.0 → 2.4.0 — the only non-stdlib finding (SNYK-GOLANG-GITHUBCOMGOVIPERMAPSTRUCTUREV2-12177854, medium).
• Dockerfile: build stage golang:1.24.4-alpine → golang:1.26.7-alpine, so the image actually compiles with the patched toolchain instead of downloading it at build time.
• third-party-licenses.{linux,darwin,windows}.md: one line each, the mapstructure version in the generated license report (required by script/licenses-check).

CI installs Go via go-version-file: go.mod and so builds, tests and license-checks with 1.26.7.

A toolchain go1.26.7 directive with the go directive left at 1.23.7 was tried first (to keep the pinned linter happy) and does not work: setup-go then installs 1.23.7 as GOROOT while the go command switches to the 1.26.7 toolchain, and go-licenses fails to load stdlib packages under that mismatch (Package errors does not have module info), breaking license-check. Reproduced locally with GOROOT 1.24.0 + toolchain go1.26.7.

Before / after (snyk test --all-projects, gomodules / go.mod)

	critical	high	medium	low
before	0	13	16	1
after	0	0	0	0

Before: found 30 issues, 202 vulnerable paths. After: no vulnerable paths found. (The Snyk UI aggregates vulnerable paths rather than issues, which is where the 92 high / 107 medium figure comes from; both go to zero.) Snyk Code reported no findings.

Fixed high-severity issues (all std/* @ 1.23.7, attributed to go.mod)

Snyk ID	package	fixed in
SNYK-GOLANG-STDNETHTTP-14548596	std/net/http	1.23.10, 1.24.4
SNYK-GOLANG-STDNETHTTP-16535158	std/net/http	1.25.10, 1.26.3
SNYK-GOLANG-STDNETHTTP-18858429	std/net/http	1.25.13, 1.26.6
SNYK-GOLANG-STDNETURL-15139468	std/net/url	1.24.12, 1.25.6
SNYK-GOLANG-STDNETURL-18858438	std/net/url	1.25.13, 1.26.6
SNYK-GOLANG-STDNET-16535159	std/net	1.25.10, 1.26.3
SNYK-GOLANG-STDNET-16535161	std/net	1.25.10, 1.26.3
SNYK-GOLANG-STDCRYPTOX509-14545542	std/crypto/x509	1.24.8, 1.25.2
SNYK-GOLANG-STDCRYPTOX509-14545554	std/crypto/x509	1.24.9, 1.25.3
SNYK-GOLANG-STDCRYPTOX509-15928851	std/crypto/x509	1.25.9, 1.26.2
SNYK-GOLANG-STDCRYPTOX509-17135840	std/crypto/x509	1.25.11, 1.26.4
SNYK-GOLANG-STDOS-17905377	std/os	1.25.12, 1.26.5
SNYK-GOLANG-STDMIME-17135844	std/mime	1.25.11, 1.26.4

Also fixed (medium/low, same mechanism): SNYK-GOLANG-STDCRYPTOX509-14545540/-14545541/-15928852, SNYK-GOLANG-STDHTMLTEMPLATE-15440731/-16535164/-16535165/-18858461/-15928853 (low), SNYK-GOLANG-STDNETHTTP-14546365, SNYK-GOLANG-STDNETURL-14546349/-15440727, SNYK-GOLANG-STDOS-14548505/-15236034/-15440726, SNYK-GOLANG-STDOSEXEC-14552249, SNYK-GOLANG-STDSYSCALL-14548504, plus the mapstructure issue above.

Verification

• go build ./..., go test ./..., go vet ./... — all pass with Go 1.26.7
• snyk test --all-projects — no vulnerable paths
• script/licenses-check diff (the initial CI failure) resolved by the license report update

Not fixed / follow-ups

• Container base images (reported, mostly out of scope): golang:1.24.4-alpine was scanned with 9 critical / 45 high OS vulnerabilities. This PR moves the build stage to golang:1.26.7-alpine, which should cut most of that, but the image's OS package set was not re-scanned here — worth a dedicated snyk container test pass. gcr.io/distroless/base-debian12 reports 43 low and no critical/high; no action recommended.
• lint CI job fails and needs a separate change (not done here): .github/workflows/lint.yml pins golangci-lint to v2.1, resolving to v2.1.6, whose binary is built with go1.24 and therefore refuses any module targeting a newer Go version: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.26.7). Any go.mod Go version high enough to clear the stdlib CVEs (≥ 1.25.13) hits this. Bumping the pin to a binary built with go1.27 (v2.13.2) makes the config load, but that release surfaces 9 pre-existing findings in files this PR does not touch — pkg/github/secret_scanning.go (4× gosec G117), internal/githubv4mock/query.go (2× govet inline), cmd/github-mcp-server/generate_docs.go and pkg/github/issues.go (3× staticcheck QF1012). Fixing those (or #nosec-ing the gosec ones) is out of scope for a dependency-security PR, so the linter bump is left as a follow-up.
• CodeQL Analyze (go) / Analyze (actions): fail at codeql database init with Error getting package versions 'github/ccr-go-queries' / 'github/ccr-actions-queries' to the public GitHub Container registry: HTTP/1.1 403 Forbidden … permission_denied: read_package — a code-scanning configuration/permission issue in this fork, independent of this PR's contents. SonarCloud likewise fails before analysis (no accessible job log; external check configuration).
• No .snyk ignores or suppressions were added, and no tests were modified.
• go.sum churn is limited to the mapstructure entries (4 lines); there is no lockfile regeneration in this PR.

Link to Devin session: https://app.devin.ai/sessions/56219133623f4adc90f76a62f059b1d7
Open in Devin Desktop: https://app.devin.ai/desktop/session/56219133623f4adc90f76a62f059b1d7?variant=devin
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE