[Sync] Update project files from source repository (c870de4) (#11)

* sync(ci): update tool versions and action hashes

* fix(security): exclude CVE-2026-26958 from Nancy scan

Adds CVE-2026-26958 (filippo.io/edwards25519@v1.1.0, CVSS 1.7 Low) to
the Nancy exclusion list. Transitive dependency; no direct upgrade path.

Author: mrz1836

.github/env/10-mage-x.env

@@ -62,7 +62,7 @@ MAGE_X_FORMAT_EXCLUDE_PATHS=vendor,node_modules,.git,.idea
 MAGE_X_GITLEAKS_VERSION=8.30.0
 MAGE_X_GOFUMPT_VERSION=v0.9.2
 MAGE_X_GOLANGCI_LINT_VERSION=v2.10.1
-MAGE_X_GORELEASER_VERSION=v2.13.3
+MAGE_X_GORELEASER_VERSION=v2.14.1
 MAGE_X_GOVULNCHECK_VERSION=v1.1.4
 MAGE_X_GO_SECONDARY_VERSION=1.24.x
 MAGE_X_GO_VERSION=1.24.x

.github/env/90-project.env

@@ -38,8 +38,8 @@ GO_COVERAGE_EXCLUDE_PATHS=.github/,.mage-cache/,.vscode/,bin/,example/,examples/
 # ================================================================================================
 
 # Custom exclusions for AskNancy vulnerability scanning
-NANCY_EXCLUDES=CVE-2024-38513,CVE-2023-45142,CVE-2025-64702,CVE-2021-43668,CVE-2023-26248,CVE-2026-24051,CVE-2026-26014
-MAGE_X_CVE_EXCLUDES=CVE-2024-38513,CVE-2023-45142,CVE-2025-64702,CVE-2021-43668,CVE-2023-26248,CVE-2026-24051,CVE-2026-26014
+NANCY_EXCLUDES=CVE-2024-38513,CVE-2023-45142,CVE-2025-64702,CVE-2021-43668,CVE-2023-26248,CVE-2026-24051,CVE-2026-26014,CVE-2026-26958
+MAGE_X_CVE_EXCLUDES=CVE-2024-38513,CVE-2023-45142,CVE-2025-64702,CVE-2021-43668,CVE-2023-26248,CVE-2026-24051,CVE-2026-26014,CVE-2026-26958
 
 # CVE-2025-64702 for quic-go@v0.55.0
 #
@@ -61,6 +61,12 @@ MAGE_X_CVE_EXCLUDES=CVE-2024-38513,CVE-2023-45142,CVE-2025-64702,CVE-2021-43668,
 #  Module: go.opentelemetry.io/otel/sdk
 #    Found in: go.opentelemetry.io/otel/sdk@v1.39.0
 
+# CVE-2026-26958 for filippo.io/edwards25519@v1.1.0
+# Improper Initialization (CWE-665) - MultiScalarMult returns incorrect results if receiver
+# is not the identity point. Rarely-used advanced API; does not affect users via go-sql-driver/mysql.
+# Fixed in: filippo.io/edwards25519@v1.1.1 (transitive dependency; no direct upgrade path)
+# CVSS Score: 1.7/10 (Low) - Monitoring: track upstream for removal of v1.1.0 transitive dep
+
 # CVE-2026-26014 for github.com/pion/dtls/v2@v2.2.12
 # Information Exposure (CWE-200) - Random nonce generation with GCM ciphers
 # Affects: pion/dtls/v2 v1.0.0 through v2.2.12 (v2.2.12 is latest in v2 branch)

.github/workflows/codeql-analysis.yml

@@ -46,7 +46,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
       # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -67,4 +67,4 @@ jobs:
       #    uses a compiled language
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4

.github/workflows/scorecard.yml

@@ -68,7 +68,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -77,6 +77,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable the upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           sarif_file: results.sarif