Bump Go toolchain to 1.26.4

Move the project from the Go 1.25 line to the latest stable Go 1.26.4.

- go.mod: go directive 1.25.0 -> 1.26.0 (language floor; no toolchain
  directive introduced by `go mod tidy`)
- Dockerfile: golang:1.25.11-alpine -> golang:1.26.4-alpine, repinned to
  the current index digest
- .github/workflows/lint.yml: go-version 1.25 -> 1.26 (other workflows use
  go-version-file: go.mod and follow automatically)
- .github/copilot-instructions.md: update Dockerfile reference
- .golangci.yml: disable only the modernize `newexpr` analyzer; the Go 1.26
  new(expr) feature otherwise flags ~1.2k github.Ptr() call sites, which is
  out of scope for a toolchain bump

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

.github/copilot-instructions.md

@@ -94,7 +94,7 @@ go test ./pkg/github -run TestGetMe
 
 - **go.mod / go.sum:** Go module dependencies (Go 1.24.0+)
 - **.golangci.yml:** Linter configuration (v2 format, ~15 linters enabled)
-- **Dockerfile:** Multi-stage build (golang:1.25.8-alpine → distroless)
+- **Dockerfile:** Multi-stage build (golang:1.26.4-alpine → distroless)
 - **server.json:** MCP server metadata for registry
 - **.goreleaser.yaml:** Release automation config
 - **.gitignore:** Excludes bin/, dist/, vendor/, *.DS_Store, github-mcp-server binary

.github/workflows/lint.yml

@@ -18,7 +18,7 @@ jobs:
         uses: ./.github/actions/build-ui
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version: '1.26'
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:

.golangci.yml

@@ -35,6 +35,14 @@ linters:
           - revive
         text: "var-naming: avoid package names that conflict with Go standard library package names"
   settings:
+    modernize:
+      # The newexpr modernizer rewrites pointer-helpers such as github.Ptr(x)
+      # into the Go 1.26 new(expr) builtin. Adopting it touches ~1.2k call sites
+      # across the codebase, which is out of scope for a toolchain bump. Disable
+      # it here so the rest of the modernize suite stays active; adopting
+      # new(expr) can be done as a separate, focused change.
+      disable:
+        - newexpr
     staticcheck:
       checks:
         - "all"

Dockerfile

@@ -7,7 +7,7 @@ COPY ui/ ./ui/
 RUN mkdir -p ./pkg/github/ui_dist && \
     cd ui && npm run build
 
-FROM golang:1.25.11-alpine@sha256:8d95af53d0d58e1759ddb4028285d9b1239067e4fbf4f544618cad0f60fbc354 AS build
+FROM golang:1.26.4-alpine@sha256:f1ddd9fe14fffc091dd98cb4bfa999f32c5fc77d2f2305ea9f0e2595c5437c14 AS build
 ARG VERSION="dev"
 
 # Set the working directory

go.mod

@@ -1,6 +1,6 @@
 module github.com/github/github-mcp-server
 
-go 1.25.0
+go 1.26.0
 
 require (
 	github.com/go-chi/chi/v5 v5.3.0