docs: update release notes for Go 1.26.3 CVE coverage (cloudnative-pg#10649)

Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>

Author: mnencia

docs/src/release_notes/v1.28.md

@@ -37,11 +37,18 @@ on the release branch in GitHub.
   ([#10436](https://github.com/cloudnative-pg/cloudnative-pg/pull/10436),
   [#10498](https://github.com/cloudnative-pg/cloudnative-pg/pull/10498))
 
-- **CVE remediation in the Go runtime**: built with Go 1.26.2 to pick up
-  upstream fixes for CVE-2026-32280 (cert-chain DoS), CVE-2026-32281
-  (policy-mapping DoS), and CVE-2026-33810 (DNS-constraint bypass on
-  wildcard SANs) in `crypto/x509` and `crypto/tls`.
-  ([#10462](https://github.com/cloudnative-pg/cloudnative-pg/pull/10462))
+- **CVE remediation in the Go runtime**: built with Go 1.26.3 to pick up
+  upstream fixes in `crypto/x509`, `crypto/tls`, `net/http`, and `net`
+  (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33814,
+  CVE-2026-33811, CVE-2026-39825).
+  ([#10462](https://github.com/cloudnative-pg/cloudnative-pg/pull/10462),
+  [#10647](https://github.com/cloudnative-pg/cloudnative-pg/pull/10647)) <!-- 1.29 1.28 1.25 -->
+
+- **Build pipeline hardening**: the Go 1.26.3 bump also addresses
+  CVE-2026-42501 (`cmd/go` module-checksum validation), reducing
+  supply-chain exposure during release builds. The affected code paths
+  are not reachable from the running operator.
+  ([#10647](https://github.com/cloudnative-pg/cloudnative-pg/pull/10647)) <!-- 1.29 1.28 1.25 -->
 
 ### Changes
 

docs/src/release_notes/v1.29.md

@@ -37,11 +37,18 @@ on the release branch in GitHub.
   ([#10437](https://github.com/cloudnative-pg/cloudnative-pg/pull/10437),
   [#10499](https://github.com/cloudnative-pg/cloudnative-pg/pull/10499))
 
-- **CVE remediation in the Go runtime**: built with Go 1.26.2 to pick up
-  upstream fixes for CVE-2026-32280 (cert-chain DoS), CVE-2026-32281
-  (policy-mapping DoS), and CVE-2026-33810 (DNS-constraint bypass on
-  wildcard SANs) in `crypto/x509` and `crypto/tls`.
-  ([#10463](https://github.com/cloudnative-pg/cloudnative-pg/pull/10463))
+- **CVE remediation in the Go runtime**: built with Go 1.26.3 to pick up
+  upstream fixes in `crypto/x509`, `crypto/tls`, `net/http`, and `net`
+  (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33814,
+  CVE-2026-33811, CVE-2026-39825).
+  ([#10463](https://github.com/cloudnative-pg/cloudnative-pg/pull/10463),
+  [#10647](https://github.com/cloudnative-pg/cloudnative-pg/pull/10647)) <!-- 1.29 1.28 1.25 -->
+
+- **Build pipeline hardening**: the Go 1.26.3 bump also addresses
+  CVE-2026-42501 (`cmd/go` module-checksum validation), reducing
+  supply-chain exposure during release builds. The affected code paths
+  are not reachable from the running operator.
+  ([#10647](https://github.com/cloudnative-pg/cloudnative-pg/pull/10647)) <!-- 1.29 1.28 1.25 -->
 
 ### Changes