[AhmedElket92]

What

Backport for a v1.3.3 patch release: bumps golang.org/x/crypto from v0.37.0 to v0.58.0 and oras.land/oras-go/v2 from v2.5.0 to v2.6.2 in all three modules, together with the Go version they need. The same x/crypto change for main is #1383.

Why

• golang.org/x/crypto v0.37.0 is affected by seven critical CVEs, all fixed in v0.52.0: CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595. v0.58.0 also clears CVE-2026-56855 and CVE-2026-78662.
• oras.land/oras-go/v2 v2.5.0 is affected by CVE-2026-50151, CVE-2026-50162, CVE-2026-50163, CVE-2026-85731, CVE-2026-85732, CVE-2026-48978 and GHSA-vh4v-2xq2-g5cg, all fixed in v2.6.2.

Bottlerocket ships notation v1.3.2 and already patches it to oras-go v2.6.2 in its own build (bottlerocket-core-kit#1070). With both bumps here, a v1.3.3 is a drop-in replacement for that patch and also fixes the x/crypto CVEs. Context: #1368.

x/crypto v0.56.0 and later require Go 1.26, so this PR also:

• raises the go directive of the three modules to 1.26.0 (Go 1.23, 1.24 and 1.25 are no longer supported upstream)
• moves the CI, CodeQL and release workflows from Go 1.23 to Go 1.26
• updates the Go requirement in building.md
• renames the three example tests in internal/tree to valid example names (ExampleNode_Print_root, _singleLayer, _multiLayer). With newer Go, go vet (which go test runs) fails on ExampleRootPrint refers to unknown identifier: RootPrint. The examples and their expected output are unchanged.

Testing (Go 1.26.10, linux/amd64)

• go build ./cmd/notation, then notation version (v1.3.2+unreleased)
• go test ./...: 14 packages pass (run without -race: no C compiler on the test machine); the three renamed examples run and pass
• go vet ./... clean in all three modules
• go mod verify: all modules verified

[AhmedElket92]

@ginglis13 since you asked for a maintenance release in #1368: this PR would give Bottlerocket a v1.3.3 with golang.org/x/crypto v0.58.0 (fixes the 7 critical x/crypto CVEs) and oras-go v2.6.2, the same version as your bottlerocket-os/bottlerocket-core-kit#1070 patch. It raises the go directive to 1.26.0, which the Bottlerocket SDK already provides (Go 1.26 and 1.27).

Would that work for Bottlerocket? A word from you here would help get it merged and released.