Bump to Go 1.26.3 (#3072)

* Bump to Go 1.26.3

Signed-off-by: Alexander Scheel <alex.scheel@control-plane.io>

* Prevent '..' as a test case, add changelog entry

See also: https://github.com/openbao/openbao/pull/3072#issuecomment-4441439595

Signed-off-by: Alexander Scheel <alex.scheel@control-plane.io>

* Upgrade golangci-lint used in CI

Signed-off-by: Jonas Köhnen <jonas.koehnen@sap.com>

---------

Signed-off-by: Alexander Scheel <alex.scheel@control-plane.io>
Signed-off-by: Jonas Köhnen <jonas.koehnen@sap.com>
Co-authored-by: Jonas Köhnen <jonas.koehnen@sap.com>

.github/workflows/code-checker.yml

@@ -18,45 +18,35 @@ jobs:
   codechecker:
     name: Code checks
     runs-on: ubuntu-latest
+    env:
+      GOLANGCI_LINT_VERSION: v2.12
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - uses: ./.github/actions/set-up-go
       - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        if: always()
         with:
-          version: v2.5
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           only-new-issues: true
       - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         if: always()
         with:
-          version: v2.5
-          only-new-issues: true
-          working-directory: ./api
-      - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
-        if: always()
-        with:
-          version: v2.5
-          only-new-issues: true
-          working-directory: ./api/auth/approle
-      - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
-        if: always()
-        with:
-          version: v2.5
-          only-new-issues: true
-          working-directory: ./api/auth/kubernetes
-      - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
-        if: always()
-        with:
-          version: v2.5
-          only-new-issues: true
-          working-directory: ./api/auth/userpass
-      - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
-        if: always()
-        with:
-          version: v2.5
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           only-new-issues: true
           working-directory: ./sdk
+      - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        if: always()
+        with:
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          only-new-issues: true
+          working-directory: ./api
+          # ./api has additional submodules that we'd like to lint. We don't
+          # set this option globally to avoid including modules that don't
+          # need linting, such as ./tools. This would slow down the job to a
+          # noticeable degree.
+          experimental: automatic-module-directories
 
   semgrep:
     name: Semgrep

.go-version

@@ -1 +1 @@
-1.25.8
+1.26.3

changelog/3072.txt

@@ -0,0 +1,3 @@
+```release-note:change
+core: `net/http.ServeMux` in Go 1.26.x now uses 307 redirect instead of 301 when given a bare path which doesn't exist in the multiplexer but which a path with a trailing slash exists for. This causes some `POST`/`PUT` operations to fail with a 400 instead of 404, as OpenBao does not allow writes to paths ending in a slash. See also: https://go.dev/doc/go1.26.
+```

http/sys_namespaces_test.go

@@ -26,7 +26,6 @@ func FuzzNamespaceName(f *testing.F) {
 	TestServerAuth(f, addr, token)
 
 	f.Add(".")
-	f.Add("..")
 	f.Add("/")
 	f.Add("foo/bar")
 	f.Add("sys")
@@ -51,7 +50,7 @@ func FuzzNamespaceName(f *testing.F) {
 		switch {
 		// exact values
 		case name == "..":
-			expect = http.StatusNotFound
+			return
 		case name == ".":
 			expect = http.StatusMethodNotAllowed
 		case name == "":