Update Go version to 1.26.5 across all modules and workflows

.github/workflows/ai-workspace-pr-check.yml

@@ -70,7 +70,7 @@ jobs:
         # requests; 502/000 means it is still warming up.
         run: |
           for i in $(seq 1 30); do
-            STATUS=$(curl -sk -o /dev/null -w "%{http_code}" https://host.docker.internal:5380/api-proxy/api/v1/organizations)
+            STATUS=$(curl -sk -o /dev/null -w "%{http_code}" https://host.docker.internal:5380/api/proxy/api/v0.9/organizations)
             if [ "$STATUS" = "200" ] || [ "$STATUS" = "401" ] || [ "$STATUS" = "403" ]; then
               echo "API proxy ready (HTTP $STATUS)"
               exit 0

.github/workflows/cli-gw-build-periodic.yml

@@ -121,7 +121,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       # ------------------------------------------------------------

.github/workflows/cli-release.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
 
       - name: Cache Go modules

.github/workflows/codecov.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/copilot-setup-steps.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: true
           cache-dependency-path: |
             gateway/**/go.sum

.github/workflows/event-gateway-integration-test-postgres.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/event-gateway-integration-test-sqlserver.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/event-gateway-integration-test.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/event-gateway-release.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
 
       - name: Set up QEMU

.github/workflows/gateway-integration-test-postgres.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/gateway-integration-test-sqlserver.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/gateway-integration-test.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/gateway-release.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
 
       - name: Set up QEMU

.github/workflows/go-scan.yaml

@@ -17,7 +17,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
       - name: Install Gosec
         run: go install github.com/securego/gosec/v2/cmd/gosec@latest
@@ -42,7 +42,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
       - name: Install Gosec
         run: go install github.com/securego/gosec/v2/cmd/gosec@latest
@@ -67,7 +67,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
       - name: Install Gosec
         run: go install github.com/securego/gosec/v2/cmd/gosec@latest
@@ -92,7 +92,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
       - name: Install Gosec
         run: go install github.com/securego/gosec/v2/cmd/gosec@latest
@@ -117,7 +117,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
       - name: Install Gosec
         run: go install github.com/securego/gosec/v2/cmd/gosec@latest

.github/workflows/operator-integration-test.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up QEMU

.github/workflows/platform-api-devportal-e2e.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/platform-api-gateway-e2e.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

.github/workflows/platform-api-pr-check.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Go build
@@ -73,7 +73,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Cross-database integration tests (PostgreSQL)
@@ -97,7 +97,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Start SQL Server

.github/workflows/platform-api-release.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
 
       - name: Set up Docker Buildx

.github/workflows/sample-service-pr-check.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Go build

.github/workflows/sample-service-release.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache: false
 
       - name: Set up QEMU

.github/workflows/sdk-integration-test.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.2'
+          go-version: '1.26.5'
           cache-dependency-path: '**/go.sum'
 
       - name: Set up Docker Buildx

cli/it/go.mod

@@ -1,6 +1,6 @@
 module github.com/wso2/api-platform/cli/it
 
-go 1.26.2
+go 1.26.5
 
 require (
 	github.com/cucumber/godog v0.15.0

cli/src/go.mod

@@ -1,6 +1,6 @@
 module github.com/wso2/api-platform/cli
 
-go 1.26.2
+go 1.26.5
 
 require (
 	github.com/spf13/cobra v1.10.1

common/go.mod

@@ -1,6 +1,6 @@
 module github.com/wso2/api-platform/common
 
-go 1.26.2
+go 1.26.5
 
 require (
 	github.com/MicahParks/jwkset v0.11.0

event-gateway/gateway-runtime/Dockerfile

@@ -20,7 +20,7 @@
 # Uses event-gateway-builder to compile the event-gateway binary with embedded policies
 
 # Stage 1: Builder Base — compile the event-gateway-builder tool
-FROM --platform=$BUILDPLATFORM golang:1.26.2-bookworm AS builder-base
+FROM --platform=$BUILDPLATFORM golang:1.26.5-bookworm AS builder-base
 ARG BUILDARCH
 ARG VERSION=unknown
 ARG GIT_COMMIT=unknown
@@ -106,7 +106,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
         -out-dir /api-platform/output
 
 # Stage 3: Minimal runtime image
-FROM alpine:3.22
+FROM alpine:3.24
 
 ARG VERSION=unknown
 

event-gateway/gateway-runtime/go.mod

@@ -1,6 +1,6 @@
 module github.com/wso2/api-platform/event-gateway/gateway-runtime
 
-go 1.26.2
+go 1.26.5
 
 require (
 	github.com/envoyproxy/go-control-plane/envoy v1.36.0

event-gateway/webhook-listener/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.26.2-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS builder
 
 ARG TARGETOS=linux
 ARG TARGETARCH

event-gateway/webhook-listener/go.mod

@@ -1,3 +1,3 @@
 module github.com/wso2/api-platform/event-gateway/webhook-listener
 
-go 1.26.2
+go 1.26.5

gateway/gateway-builder/Dockerfile

@@ -17,7 +17,7 @@
 # --------------------------------------------------------------------
 
 # Gateway Builder Image
-FROM --platform=$BUILDPLATFORM golang:1.26.2-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.5-bookworm AS builder
 ARG TARGETARCH
 
 # Build arguments for version information
@@ -76,12 +76,13 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     -o /usr/local/bin/gateway-builder \
     ./cmd/builder
 
-FROM golang:1.26.2-bookworm
+FROM golang:1.26.5-bookworm
 
-# Install runtime dependencies
+# Install runtime dependencies (upgrade first to pull in Debian security fixes)
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
-    apt-get update && apt-get install -y --no-install-recommends \
+    apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends \
     git \
     make \
     ca-certificates \

gateway/gateway-builder/go.mod

@@ -1,6 +1,6 @@
 module github.com/wso2/api-platform/gateway/gateway-builder
 
-go 1.26.2
+go 1.26.5
 
 require (
 	github.com/stretchr/testify v1.11.1

gateway/gateway-controller/Dockerfile

@@ -1,6 +1,6 @@
 # Stage 1: Build the Go application
 # Using Debian-based image for better cross-compilation support
-FROM --platform=$BUILDPLATFORM golang:1.26.2-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.5-bookworm AS builder
 ARG TARGETARCH
 ARG VERSION=0.0.1-SNAPSHOT
 ARG GIT_COMMIT=unknown
@@ -78,7 +78,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 # Stage: debug (select with --target debug; NOT part of the default build)
 # Full Go image needed to install dlv via go install; acceptable for dev-only use.
 # Runs as root — dlv requires ptrace; container security settings handle isolation.
-FROM golang:1.26.2-bookworm AS debug
+FROM golang:1.26.5-bookworm AS debug
 WORKDIR /app
 
 # Install dlv (Delve debugger)

gateway/gateway-controller/go.mod

@@ -1,6 +1,6 @@
 module github.com/wso2/api-platform/gateway/gateway-controller
 
-go 1.26.2
+go 1.26.5
 
 require (
 	github.com/envoyproxy/go-control-plane v0.14.0

gateway/gateway-runtime/Dockerfile

@@ -24,7 +24,7 @@
 ARG ENVOY_VERSION=v1.38.0
 
 # Stage 1: Builder Base
-FROM --platform=$BUILDPLATFORM golang:1.26.2-bookworm AS builder-base
+FROM --platform=$BUILDPLATFORM golang:1.26.5-bookworm AS builder-base
 ARG BUILDARCH
 ARG VERSION=unknown
 ARG GIT_COMMIT=unknown
@@ -181,7 +181,7 @@ RUN if [ "$PYTHON_SDK_SOURCE" = "local" ]; then \
 RUN pip3 freeze --path /app/python-libs > /app/python-libs/requirements-lock.txt
 
 # Stage 3b: dlv installer (builds dlv for the debug stage)
-FROM golang:1.26.2-bookworm AS debug-dlv-builder
+FROM golang:1.26.5-bookworm AS debug-dlv-builder
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go install github.com/go-delve/delve/cmd/dlv@v1.26.0

gateway/gateway-runtime/policy-engine/go.mod

@@ -1,6 +1,6 @@
 module github.com/wso2/api-platform/gateway/gateway-runtime/policy-engine
 
-go 1.26.2
+go 1.26.5
 
 require (
 	github.com/andybalholm/brotli v1.2.0