Security: bump ui-server Go to >= 1.26.5 to address CVE-2026-27145 and CVE-2026-39822

[acquia-patchbot]

Summary

Two Go stdlib CVEs affect the ui-server binary (temporalio/ui-server, currently v2.53.1 using go 1.26.3). Note: temporalio/ui-server has issues disabled so filing here.

CVE	Severity	Description	Patched at
CVE-2026-27145	MEDIUM (5.3)	crypto/x509 DoS — excessive CPU on x509 cert verification with many DNS SAN entries	Go 1.26.4
CVE-2026-39822	MEDIUM (4.4)	os.Root symlink traversal on Unix	Go 1.26.5

Request

Please bump the go directive in temporalio/ui-server go.mod to >= 1.26.5 and cut a new release.

References:

• https://pkg.go.dev/vuln/GO-2026-5037 (CVE-2026-27145)
• https://pkg.go.dev/vuln/GO-2026-4970 (CVE-2026-39822)
• https://nvd.nist.gov/vuln/detail/CVE-2026-27145
• https://nvd.nist.gov/vuln/detail/CVE-2026-39822