[mrz1836]

What Changed

• Updated Go version in devcontainer from 1.24 to 1.26 in .devcontainer.json
• Added docs/** to codecov ignore paths in codecov.yml
• Updated security tool versions in .github/env/10-security.env:
  • GOVULNCHECK_VERSION from v1.7.0 to v1.8.0
  • OSV_SCANNER_VERSION from v2.5.1 to v2.6.0
  • Added SHA-256 digest pins for OSV-Scanner binaries (OSV_SCANNER_SHA256_LINUX_AMD64 and OSV_SCANNER_SHA256_LINUX_ARM64)
• Updated tool versions in .github/env/10-mage-x.env:
  • MAGE_X_VERSION from v1.26.5 to v1.27.2
  • MAGE_X_GORELEASER_VERSION from v2.18.0 to v2.18.1
  • MAGE_X_GOVULNCHECK_VERSION from v1.7.0 to v1.8.0
  • MAGE_X_OSV_SCANNER_VERSION from v2.5.1 to v2.6.0
  • MAGE_X_BENCHSTAT_VERSION_LATEST from v0.0.0-20260825160852-19be9d8e6c70 to v0.0.0-20260908200009-22c9c6c9d4da
  • Added dual-version support for gofumpt with MAGE_X_GOFUMPT_VERSION_LATEST=v0.12.0 and MAGE_X_GOFUMPT_VERSION_LATEST_MIN_GO=1.26
• Added dual-version support for gofumpt in .github/env/10-pre-commit.env with GO_PRE_COMMIT_FUMPT_VERSION_LATEST=v0.12.0 and GO_PRE_COMMIT_FUMPT_VERSION_LATEST_MIN_GO=1.26
• Updated GO_COVERAGE_VERSION from v1.6.0 to v1.6.1 in .github/env/10-coverage.env
• Updated CodeQL action references in .github/workflows/codeql-analysis.yml and .github/workflows/scorecard.yml
• Refactored OSV-Scanner installation in .github/workflows/fortress-security-scans.yml to download and verify official release binaries using SHA-256 digests instead of using go install

Why It Was Necessary

• Automated synchronization to keep development environment, security scanning tools, and CI workflows aligned with latest stable versions
• OSV-Scanner installation method changed from go install to prebuilt binary verification to eliminate transitive dependency on sum.golang.org and avoid HTTP/2 stream reset failures
• Dual-version gofumpt support enables newer tool versions on Go 1.26+ while maintaining compatibility with Go 1.25.x repositories

Testing Performed

• Version pin updates are automatically validated by the version checker tool (magefiles/version_checker.go)
• OSV-Scanner SHA-256 digests are verified against official release checksums from GitHub releases
• CI workflow changes will be validated by the next automated workflow run on this PR

Impact / Risk

• Low Risk: Changes are configuration updates for development tools and CI workflows with no production code modifications
• Breaking Change: None - dual-version tool support maintains backward compatibility with older Go versions
• CI Reliability: OSV-Scanner binary verification approach improves supply chain security and reduces dependency on external checksum services

[mrz1836]

LGTM!