mongo-tools 100.18.0 (and current master as of 2026-09-11) is built with Go 1.26.5,
which is affected by 10 stdlib CVEs, all already fixed in Go 1.25.13, 1.26.6, or
1.27.0-rc.3:

• CVE-2026-39821 (Critical, 9.6) — idna ToASCII/ToUnicode confusion → privilege escalation
• CVE-2026-56865 (High, 8.4) — malicious GOPROXY forges sumdb tiles, bypasses GOSUMDB
• CVE-2026-56859 (High, 7.5) — encoding/xml DecodeElement depth-counter reset → stack exhaustion
• CVE-2026-56864 (High, 7.5) — malicious GOSUMDB serves undetectable module content
• CVE-2026-56862 (High, 7.5) — TLS KeyUpdate always handshake-advancing → DoS
• CVE-2026-56853 (High, 7.5) — HTTP/2 cleartext preface read bypasses ReadHeaderTimeout
• CVE-2026-46600 (High, 7.5) — SVCB/HTTPS RR parsing panic
• CVE-2026-33818 (High, 7.5) — missing recursion limit in Unmarshal → stack exhaustion
• CVE-2026-56860 (Medium, 5.9) — quadratic-time path cleaning
• CVE-2026-56858 (Medium, 6.1) — unescaped '/' closes early → content injection

Requested action: bump the pinned Go version past 1.26.5, following the same pattern
as PR #1058 ("Upgrade to Go 1.26.5", merged 2026-07-27 for CVE-2026-42505), which
touched go.mod, mise.toml, and the regenerated cyclonedx.sbom.json.