fix: bump Go to 1.26.2 for upstream security fixes

Update go.mod and all golang build images from 1.26.1 to 1.26.2 to pick up the upstream 2026-04-07 security release.

This includes fixes for CVE-2026-32280 / CVE-2026-32281 in crypto/x509, CVE-2026-32283 in crypto/tls, and the related toolchain and standard library security fixes shipped in go1.26.2, without changing any unrelated dependencies.

Dockerfile.goreleaser

@@ -1,4 +1,4 @@
-FROM golang:1.26.1-alpine AS build
+FROM golang:1.26.2-alpine AS build
 
 ARG TARGETARCH
 

Dockerfile.hotfix

@@ -1,4 +1,4 @@
-FROM golang:1.26.1-alpine as build
+FROM golang:1.26.2-alpine as build
 
 ARG TARGETARCH
 ARG RELEASE

Dockerfile.release

@@ -1,4 +1,4 @@
-FROM golang:1.26.1-alpine AS build
+FROM golang:1.26.2-alpine AS build
 
 ARG TARGETARCH
 ARG RELEASE

Dockerfile.release.old_cpu

@@ -1,4 +1,4 @@
-FROM golang:1.26.1-alpine AS build
+FROM golang:1.26.2-alpine AS build
 
 ARG TARGETARCH
 ARG RELEASE

go.mod

@@ -1,6 +1,6 @@
 module github.com/minio/minio
 
-go 1.26.1
+go 1.26.2
 
 // Use Georg Mangold's maintained Console fork while keeping upstream import paths.
 replace github.com/minio/console => github.com/georgmangold/console v1.9.1