Two High CVEs in 1.26.8, both already fixed on master

1.26.8 has two High CVEs, and both are already fixed on master. So this is really a "please tag a release" issue.

[CVE-2026-33186](https://osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3) is a gRPC-Go authorization bypass via a missing leading slash in `:path`, CVSS 9.1. The image has grpc v1.77.0, the fix landed in 1.79.3, master is on v1.83.0.

[CVE-2025-68121](https://pkg.go.dev/vuln/GO-2026-4337) is a crypto/tls session resumption bug. The image is built with Go 1.25.5, the fix is 1.25.7, and master's `.go-version` already says 1.25.7.

Nothing needs writing. The fixes just aren't in a tag, and 1.26.8 is the newest tag there is.

I doubt either is actually exploitable here. The gRPC one needs a server doing path-based authorization, the TLS one needs CA pools mutated between handshakes, and a DNS cache does neither. But scanners don't know that. They flag both on the only tag available, so people end up filing exceptions or building their own images, which is what #33 describes.

Any chance of a release? Or even a patch tag with just the grpc bump, given the 9.1.

Start by reviewing the repository's release process and comparing tag 1.26.8 with master, including the mentioned .go-version. Confirm the grpc and Go fixes are included in the intended release contents; done means a new tag and image are published so scanners no longer report these CVEs.

Written by the indexing model from the issue text.