govulncheck on GitHub's runner (GOTOOLCHAIN=local, Go from go.mod) reports GO-2026-6809 in crypto/x509 on 1.26.9, reachable from main. go.mod moves to 1.26.10 and the Gitea CI image to the 1.26-bookworm digest that ships it, the same bump stalwart-migrator made in its #22.