chore(deps): update package version and pin CI to Go 1.26.5

[emilyzhangbg]

Description

Updates dependencies to clear outstanding vulnerability advisories and aligns the CI/release toolchain with the module's Go requirement.

Dependency updates

• sigstore v1.9.4 → v1.10.8, sigstore-go v1.0.0 → v1.2.0, and the transitive go-openapi / otel / grpc trees that follow from them.
• golang.org/x/text v0.37.0 → v0.40.0 — clears GO-2026-5970 (infinite loop on invalid input).
• golang.org/x/net v0.55.0 → v0.57.0 — clears GO-2026-5942 (panic parsing an invalid SVCB/HTTPS RR).
• golang.org/x/crypto v0.52.0 → v0.54.0, pulling x/mod, x/sync, x/sys, and x/term forward transitively.
• go directive 1.23.0 → 1.25.0.

Toolchain pin
CI and release workflows pinned Go 1.23 while go.mod required 1.25.0. Both
are now pinned to 1.26.5 (ci.yml, and both jobs in release.yml).

Checklist

• I am familiar with the Contributing Guidelines.
• My commits are signed off (git commit -s) per the DCO in the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

Summary by CodeRabbit

• Chores
  • Updated the Go toolchain used for testing, validation, and releases.
  • Refreshed the project’s Go version requirement and supporting dependencies.
  • Improved compatibility with newer Go tooling and library versions.
• Bug Fixes
  • Improved formatting of a verification-failure message to make guidance clearer.
• Chores
  • Updated lint configuration to align with the newer lint tool version and exclusion handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 74fa72dc-d1bb-4d9a-bbc4-d8da6cd2a22b

📥 Commits

Reviewing files that changed from the base of the PR and between 53b2ccb and 96f2aa5.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .golangci.yml
• cmd/nvfleetctl/report.go

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The Go module directive and dependencies are updated, CI and release workflows now use Go 1.26.5, golangci-lint v2 configuration is adopted, and a verification failure message is reformatted.

Changes

Go toolchain and quality configuration

Layer / File(s)	Summary
Module requirements and dependency refresh go.mod	The Go directive changes to 1.25.0, Sigstore dependencies are upgraded, and indirect dependencies are refreshed.
CI and lint toolchain alignment .github/workflows/ci.yml, .github/workflows/release.yml, .golangci.yml	CI and release jobs use Go 1.26.5, the lint action moves to v8, and the lint configuration adopts the v2 schema and exclusions format.
Verification error message formatting cmd/nvfleetctl/report.go	The verification failure message removes punctuation after the first sentence and moves guidance to a new line.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/nvcf#228: Updates golangci-lint configuration to the v2 schema.
• NVIDIA/nvcf#473: Updates CI workflow Go toolchain declarations to Go 1.26.5.

Suggested reviewers: jingxiang-z

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main changes: dependency updates and pinning CI/release workflows to Go 1.26.5.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/package-version

---

_{Comment @coderabbitai help to get the list of available commands.}