Upgrade Go to 1.26.x

[belimawr]

Upgrade Go to the latest 1.26.

Changes that are currently affecting us

net/http - Changelog

Client now uses and sets cookies scoped to URLs with the host portion matching Request.Host when available. Previously, the connection address host was always used. ServeMux trailing slash redirects now use HTTP status 307 (Temporary Redirect) instead of 301 (Moved Permanently).

This breaks TestMux/path_clean_conformance from x-pack/filebeat/input/http_endpoint/input_test.go:890

=== RUN   TestMux/path_clean_conformance
    input_test.go:922: path "/a//b": status mux=301, http.ServeMux=307
    input_test.go:922: path "/a/b/../": status mux=301, http.ServeMux=307
    input_test.go:922: path "/a/./b": status mux=301, http.ServeMux=307
    input_test.go:922: path "/x///y/z/": status mux=301, http.ServeMux=307
    input_test.go:922: path "/x/y/z/../z/": status mux=301, http.ServeMux=307
    input_test.go:922: path "/x/y/../y/z/": status mux=301, http.ServeMux=307
--- FAIL: TestMux (0.00s)

I've already pinged the team that owns the http_endpoint input for help on how they want to fix that.

PR updating the behaviour: #50686

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

tl;dr: bump-golang is currently patch-only on the existing minor (1.25), so 1.26.x will likely require a one-time explicit minor jump PR before automation can continue normally.

Recommendation

Create a dedicated PR that performs the minor jump to 1.26.x across the same surfaces covered by the last automation bump, then keep the existing scheduled automation for future 1.26.y patch bumps.

Findings

1. The update automation derives the Go minor from .go-version and filters releases to that same minor:

• .github/workflows/updatecli.d/bump-golang.yml:31 — name: Get minor version in .go-version
• .github/workflows/updatecli.d/bump-golang.yml:38 — command: cat .go-version
• .github/workflows/updatecli.d/bump-golang.yml:54 — pattern: v1\.{{ source "minor" }}\.(\d*)$

2. Current repo minor is 1.25:

• .go-version:1 — 1.25.9
• go.mod:3 — go 1.25.9

3. The scheduled workflow uses that updatecli config directly:

• .github/workflows/bump-golang.yml:23 — command: --experimental apply --config .github/workflows/updatecli.d/bump-golang.yml ...

4. Recent precedent (#50049) shows the expected change surface for a Go bump PR:

• #50049 title: [Automation] Bump Golang version to 1.25.9
• #50049 metadata: changed_files: 15
• Changed files include .go-version, go.mod, libbeat/docs/version.asciidoc, multiple Dockerfiles, and .devcontainer/devcontainer.json.

Verification

I validated the minor-extraction behavior locally:

$ sed -n '1p' .go-version
1.25.9

$ sed -nE 's/^[0-9]+\.([0-9]+)\.[0-9]+$/\1/p' .go-version
25

And confirmed current pinned version surfaces:

$ rg -n "1\.25\.9" {key files...}
.go-version:1:1.25.9
go.mod:3:go 1.25.9
libbeat/docs/version.asciidoc:3::go-version: 1.25.9
auditbeat/Dockerfile:1:FROM golang:1.25.9-bookworm
heartbeat/Dockerfile:1:FROM golang:1.25.9-bookworm
metricbeat/Dockerfile:1:FROM golang:1.25.9-bookworm
packetbeat/Dockerfile:1:FROM golang:1.25.9-bookworm
metricbeat/module/http/_meta/Dockerfile:1:FROM golang:1.25.9-bookworm
metricbeat/module/vsphere/_meta/Dockerfile:2:FROM golang:1.25.9-bookworm
x-pack/metricbeat/module/stan/_meta/Dockerfile:5:FROM golang:1.25.9-bookworm AS build-env
dev-tools/kubernetes/filebeat/Dockerfile.debug:1:FROM golang:1.25.9-bookworm as builder
dev-tools/kubernetes/metricbeat/Dockerfile.debug:1:FROM golang:1.25.9-bookworm as builder
dev-tools/kubernetes/heartbeat/Dockerfile.debug:1:FROM golang:1.25.9-bookworm as builder

Detailed Action Plan

1. Prepare a one-time Go 1.26.x bump PR updating all version-pinned files tracked by the current automation manifest (.github/workflows/updatecli.d/bump-golang.yml:92-229), including:
   • .go-version
   • go.mod
   • libbeat/docs/version.asciidoc
   • .devcontainer/devcontainer.json
   • all Dockerfiles listed in that manifest
2. Confirm no stale 1.25.x pins remain in the target surface with rg over those files.
3. Add changelog fragment under changelog/fragments/ (same pattern as the previous Go bump PR).
4. Run required checks for the change set (at minimum mage check from the relevant beat/root workflow path).
5. Merge the minor-jump PR; after that, keep the scheduled bump-golang workflow as-is for 1.26.y patch updates.

Related Items

Type	Link / File	Relevance
Issue	#50640	Current request to upgrade to Go 1.26.x
PR	#50049	Latest Go bump precedent (1.25.9), shows expected file surface
Workflow	.github/workflows/bump-golang.yml:23	Scheduled job that executes the updatecli manifest
Manifest	.github/workflows/updatecli.d/bump-golang.yml:30-55	Minor extraction + version filter logic
Version source	.go-version:1	Current minor/patch source for automation
Module directive	go.mod:3	Go directive currently pinned to 1.25.9

Note

🔒 Integrity filter blocked 22 items

The following items were blocked because they don't meet the GitHub integrity level.

• #49091 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #49035 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #50226 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #46793 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #34399 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #48822 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #38079 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #30098 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #26738 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #44585 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #45009 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #45010 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #45012 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #45011 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #36869 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #35840 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 6 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[mauri870]

@belimawr Do you plan to update Elastic Agent as well?

EDIT: Nvm, was done in elastic/elastic-agent@d3950e6.