[Vasanthdev2004]

What changed

Bump the go directive to 1.26.11. CI and release builds read the toolchain from go.mod, so that is the only version they use. The stated source-build minimum in README.md, README_ZH.md and docs/INSTALL.md moves with it, as in #1168. CHANGELOG.md is left to release-please.

Why

govulncheck reads the live database, and GO-2026-6859 was added to it after main last went green on 2026-11-10. Security & Code Health now fails on every open PR (#835 and #1211 today) with no code change behind it, and main will fail the same way on its next run:

Vulnerability #1: GO-2026-6859
    HTTP/1 server crash due to MaxBytesReader header race in net/http
  Standard library
    Found in: net/http@go1.26.10
    Fixed in: net/http@go1.26.11
    Example traces found:
      #11: internal/oauth/callback_server.go:53:21: oauth.startCallbackServer calls http.Server.Serve

It is fixed in 1.26.11. Same shape as #1168.

Linked issue

None. Maintainer fix for a required check that is red on every PR, opened through the internal development process.

Verification

On Windows, with the pinned govulncheck@v1.3.0 run for GOOS=linux and for GOOS=windows, the way the two CI steps run it:

• A tree on Go 1.26.10: both report GO-2026-6859 and exit 3.
• This branch on Go 1.26.11: both report no vulnerabilities and exit 0.

Also on this branch: go vet ./... for windows, linux and darwin, the release build and smoke, go test ./..., and git diff --check.

Summary by CodeRabbit

• Documentation
  • Updated the Go version requirement for installation and source builds to Go 1.26.11 or later across the project documentation.
• Chores
  • Updated the project’s Go toolchain version to 1.26.11.

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: 6bb2154cdffc
Changed files (4): README.md, README_ZH.md, docs/INSTALL.md, go.mod

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The Go toolchain directive and documented Go version requirements change from 1.26.10 to 1.26.11.

Changes

Go Version Requirement

Layer / File(s)	Summary
Update Go version requirement go.mod, README.md, README_ZH.md, docs/INSTALL.md	The Go directive, version badges, and build instructions specify Go 1.26.11 instead of 1.26.10.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Minimal · up to 6bb21

The Go version requirement is consistent across the module and documentation. No merge-blocking issue was identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the Go version bump to 1.26.11 and links it to GO-2026-6859, which matches the main changes.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Twigpine/zero
• Branch: fix/go-1.26.11-GO-2026-6859
• File: .coderabbit.yaml
• Commit: 6bb2154
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Essentials
• Run ID: efe69e1f-add2-461a-a9e8-083a3d963c7d

Commits

Reviewing files that changed from the base of the PR and between 17fcd26 and 6bb2154.

Files selected for processing: 4

• README.md
• README_ZH.md
• docs/INSTALL.md
• go.mod

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[jatmn]

Merge readiness

Rebase onto current main (ecd6e115) before merge. The branch merge-base is one commit behind live main (#1213). A trial merge shows no conflicts on the four changed files; rebasing is still the project’s stated fresh-base expectation in AGENTS.md.

Prebuilt GitHub Release and npm platform binaries compiled at Go 1.26.10 will continue to carry GO-2026-6859 until the next release artifact cut. That is expected for a go.mod-only bump and is not blocked by this diff, but maintainers should plan a release after merge if they want install-by-binary users on the patched stdlib immediately.

Optional follow-up (not required for this PR): bin/zero.js still says Go 1.26+ in the missing-binary source-recovery path—the same coarse wording #1168 left unchanged. After this bump, 1.26.10 no longer satisfies go.mod while it still fits “1.26+”. Aligning that string with 1.26.11+ would reduce confusion on the npm fallback path; it is outside the #1168 file scope this PR intentionally mirrors.

🟢 Thanks for the contribution. I do not see any actionable issues from my review.