Upgrade Go to 1.26.2 to fix stdlib CVEs (v5.4.30) (#4173)

* Upgrade Go to 1.26.2 to fix stdlib CVEs (v5.4.30)

Fixes GO-2026-4865 (html/template XSS), GO-2026-4866 (crypto/x509 auth bypass),
GO-2026-4869 (archive/tar DoS), GO-2026-4870 (crypto/tls DoS), GO-2026-4946 (crypto/x509 DoS)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix CircleCI Go image version to 1.26.2

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: reinkrul

.circleci/config.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     parallelism: 8
     docker:
-      - image: cimg/go:1.26.1
+      - image: cimg/go:1.26.2
     steps:
       - checkout
 
@@ -37,7 +37,7 @@ jobs:
 
   report:
     docker:
-      - image: cimg/go:1.26.1
+      - image: cimg/go:1.26.2
     steps:
       - checkout
       - attach_workspace:

Dockerfile

@@ -1,5 +1,5 @@
 # golang alpine
-FROM golang:1.26.1-alpine AS builder
+FROM golang:1.26.2-alpine AS builder
 
 ARG TARGETARCH
 ARG TARGETOS

docs/pages/release_notes.rst

@@ -3,6 +3,16 @@
 Release notes
 #############
 
+*************************
+Hazelnut update (v5.4.30)
+*************************
+
+Release date: 2026-04-10
+
+- Upgrade Go to 1.26.2 to fix GO-2026-4865 (html/template XSS), GO-2026-4866 (crypto/x509 auth bypass), GO-2026-4869 (archive/tar DoS), GO-2026-4870 (crypto/tls DoS), GO-2026-4946 (crypto/x509 DoS)
+
+**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v5.4.29...v5.4.30
+
 *************************
 Hazelnut update (v5.4.29)
 *************************

go.mod

@@ -2,7 +2,7 @@ module github.com/nuts-foundation/nuts-node
 
 // This is the minimal version, the actual go version is determined by the images in the Dockerfile
 // This version is used in automated tests such as the 'Scheduled govulncheck' action
-go 1.26.1
+go 1.26.2
 
 require (
 	github.com/alicebob/miniredis/v2 v2.34.0