Update to go1.26.2 (#8703)

This release contains several fixes for security issues in crypto/x509,
crypto/tls, and other packages. See
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU for details.

We believe we are unaffected by all issues fixed in this release, except
for a trivial potential of resource exhaustion in the VA via the
crypto/tls key update deadlock.

Author: aarongable

.github/workflows/boulder-ci.yml

@@ -36,7 +36,7 @@ jobs:
       matrix:
         # Add additional docker image tags here and all tests will be run with the additional image.
         BOULDER_TOOLS_TAG:
-          - go1.26.1_2026-03-09
+          - go1.26.2_2026-04-07
         # Tests command definitions. Use the entire "docker compose" command you want to run.
         tests:
           # Run ./test.sh --help for a description of each of the flags.
@@ -129,7 +129,7 @@ jobs:
       # When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true
       fail-fast: false
       matrix:
-        go-version: [ '1.26.1' ]
+        go-version: [ '1.26.2' ]
 
     steps:
       # Checks out your repository under $GITHUB_WORKSPACE, so your job can access it

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
       fail-fast: false
       matrix:
         GO_VERSION:
-          - "1.26.1"
+          - "1.26.2"
     runs-on: ubuntu-24.04
     permissions:
       contents: write

.github/workflows/try-release.yml

@@ -20,7 +20,7 @@ jobs:
       fail-fast: false
       matrix:
         GO_VERSION:
-          - "1.26.1"
+          - "1.26.2"
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6

docker-compose.yml

@@ -8,7 +8,7 @@ services:
       context: test/boulder-tools/
       # Should match one of the GO_CI_VERSIONS in test/boulder-tools/tag_and_upload.sh.
       args:
-        GO_VERSION: 1.26.1
+        GO_VERSION: 1.26.2
     environment:
       # To solve HTTP-01 and TLS-ALPN-01 challenges, change the IP in FAKE_DNS
       # to the IP address where your ACME client's solver is listening. This is

test/boulder-tools/tag_and_upload.sh

@@ -12,7 +12,7 @@ DOCKER_REPO="letsencrypt/boulder-tools"
 # .github/workflows/release.yml,
 # .github/workflows/try-release.yml if appropriate,
 # and .github/workflows/boulder-ci.yml with the new container tag.
-GO_CI_VERSIONS=( "1.26.1" )
+GO_CI_VERSIONS=( "1.26.2" )
 
 echo "Please login to allow push to DockerHub"
 docker login