[jiangpengcheng]

Motivation

The scheduled master scan builds the operator successfully, then fails because Trivy reports two HIGH vulnerabilities in manager:

Finding	Installed version	Patched version
CVE-2026-63209, github.com/klauspost/compress	v1.18.0	v1.18.7
CVE-2026-111943, Go crypto/x509	go1.26.9	go1.26.10

Modifications

Upgrade compress in the operator and Go sample modules, and align all Go 1.26 build images, module declarations, and CI jobs on 1.26.10. Tidy module checksums.

Verifying this change

• Make sure that the change passes the CI checks.

This change is covered by the existing unit and controller envtest suites.

• Full root-module go test -p 2 -json ./... with Go 1.26.10: passed, including all 57 controller envtest specs with Kubernetes 1.24.2.
• Go sample cross-compilation for Linux amd64: passed; binary build metadata confirms Go 1.26.10 and compress v1.18.7.
• go mod verify and go mod tidy -diff in both changed modules: passed.
• Workflow YAML parsing and git diff --check: passed.
• Linux amd64 operator image built from the repository Dockerfile: passed.
• Trivy 0.71.1 with the database updated on 2026-10-22: 0 vulnerabilities in Debian 13.7 and manager, and no secrets. The scan confirms embedded versions stdlib v1.26.10 and github.com/klauspost/compress v1.18.7.

Documentation

• no-need-doc: dependency and build-toolchain security updates; no configuration or API changes.