Locust Kubernetes Operator v2.3.1

A security and maintenance release.

🔒 Security 🔒

Six Go standard library CVEs cleared: govulncheck reported six vulnerabilities reachable from operator code, all in the Go standard library and all reaching us through the webhook server and the reconciler's client. Bumping the toolchain to Go 1.26.7 clears every one. govulncheck now reports no vulnerabilities at all (#361, commit 28b0880)
- crypto/tls: post-handshake message flood (GO-2026-6090)
- net/http: ReadHeaderTimeout not applied to the unencrypted HTTP/2 check (GO-2026-6089)
- html/template: JavaScript regexp context tracking (GO-2026-6091)
- encoding/asn1: unbounded recursion depth (GO-2026-5972)
- net/http / idna: ASCII-only Punycode labels not rejected (GO-2026-5026)
- net/url: URL parsing (GO-2026-6093)
Both the toolchain pin and the builder image had to move: CI resolves its Go version from go-version-file: go.mod, so bumping only the Dockerfile would have left the build on the vulnerable toolchain. The go directive and FROM golang: now move together (#361, commit 28b0880)
Advisories cleared ahead of reachability: cel-go to v0.30.0, go.opentelemetry.io/otel to v1.44.0 and golang.org/x/mod to v0.40.0. None are reachable from operator call paths, but the image scan matches on version rather than reachability (#361, commit 28b0880)

Kubernetes libraries to v0.36.4: k8s.io/api, apimachinery and client-go move to the current head of the 0.36 patch line. v0.37.0 is deliberately held back, because controller-runtime v0.24.1 supports the 0.36 line only, and both will move together once v0.25.0 is released (#361, commit 28b0880)
Chart images refreshed: the OpenTelemetry collector moves to 0.159.0 (fourteen minor versions) and the metrics exporter to v0.5.2. Neither is covered by any Dependabot ecosystem: the docker ecosystem parses only the Dockerfile, and helm tracks Chart.yaml dependencies rather than image tags in values.yaml (#361, commit 28b0880)
Test and tooling dependencies: testify v1.12.1, ginkgo v2.32.1, gomega v1.43.0, kustomize v5.8.1, controller-tools v0.21.0, operator-sdk v1.42.3, opm v1.73.0 (#361, commit 28b0880)

Chart README corrected: the replicaCount name and default, the memory limit, the cert-manager default, and the standalone OpenTelemetry collector were all documented inaccurately (#349, commit e74e217)
Documentation corrected across the Helm deploy, API reference, FAQ, architecture, and kind validation guides, including broken links and stale version requirements (#349, commit e74e217)
Artifact Hub metadata refreshed for this release (#350, commit 6be6263)