[jakubramut]

Description of your changes

Bumps Go to 1.26.10 on release-0.6 to pick up the crypto/x509 fix for CVE-2026-111943 (GO-2026-6809) and moves the runtime base gcr.io/distroless/base-debian12 -> base-debian13, mirroring crossplane-contrib/function-patch-and-transform#380. v0.6.0 ships a /function built with go1.25.11; the fix is only in 1.26.10 and 1.27.3. Please cut v0.6.1 from release-0.6 after merge.

GOLANGCI_VERSION moves v2.4.0 -> v2.11.4: v2.4.0 is built with Go 1.25 and refuses the module (can't load config: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.10)); v2.12.2 reports 17 goconst issues on this tree.

go.mod moves to go 1.26.10 as in #380, so every build of the module needs a 1.26.10+ toolchain. That also flips four default GODEBUG settings from their 1.25 values: cryptocustomrand, httpservecontentmaxranges, tlssecpmlkem, urlstrictcolons.

Tests

Local, Go 1.26.10:

• go mod tidy: no diff
• golangci-lint v2.11.4 config verify and run: 0 issues
• go test -v -cover ./...: 41 --- PASS, 0 --- FAIL
• govulncheck ./...: GO-2026-6809 no longer reported; 6 other reachable findings remain (4 in golang.org/x/net, fixed in v0.60.0; 2 in google.golang.org/grpc, fixed in v1.83.1), not addressed here
• docker build --platform linux/amd64 --build-arg GO_VERSION=1.26.10 --target image: /function built with go1.26.10 on Debian 13, user nonroot:nonroot, --help exits 0

I have:

• Read and followed Crossplane's contribution process.
• Added or updated unit tests for my change.

[bobh66]

@jakubramut thanks for the PR. Can you please also submit the same changes to the main branch? I don't want the release branch to be ahead of main. Thanks