- rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to pick up eight Go standard-library fixes; grafana carries no source change for these - CVE-2026-33818: enforce a maximum recursion depth in encoding/asn1 Unmarshal - CVE-2026-39820: fix quadratic complexity in consumeComment in net/mail - CVE-2026-42499: fix quadratic consumePhrase behaviour in net/mail - CVE-2026-56853: apply ReadHeaderTimeout to the unencrypted HTTP/2 preface check - CVE-2026-56858: fix JavaScript regexp context tracking in html/template - CVE-2026-56859: add a recursion depth guard during decode in encoding/xml - CVE-2026-56860: avoid quadratic complexity in resolvePath in net/url - CVE-2026-56862: bound post-handshake handshake messages in crypto/tls