Bump Go toolchain to 1.27.2, refresh x/crypto to v0.58.0 #306

2026-10-16T21:45:45Z

fen commented

2026-10-16 21:45:45 +00:00

Mechanical dependency fix from the pre-release security audit (t_fb8612a0).

go directive 1.27.1 -> 1.27.2; Dockerfile builder golang:1.27-alpine -> golang:1.27.2-alpine
golang.org/x/crypto v0.39.0 -> v0.58.0 (x/sys v0.47.0 -> v0.49.0)
go build ./... and go test ./... pass

govulncheck ./... after: 0 reachable vulnerabilities. All 9 previously reachable stdlib findings (GO-2026-6617/6613/6612/6611/6608/6603/6600/6599) are gone. Only remaining: GO-2026-5932 — x/crypto/openpgp unmaintained, module-level only, no fixed version available, and our code does not call it.

Mechanical dependency fix from the pre-release security audit (t_fb8612a0). - go directive 1.27.1 -> 1.27.2; Dockerfile builder golang:1.27-alpine -> golang:1.27.2-alpine - golang.org/x/crypto v0.39.0 -> v0.58.0 (x/sys v0.47.0 -> v0.49.0) - go build ./... and go test ./... pass govulncheck ./... after: 0 reachable vulnerabilities. All 9 previously reachable stdlib findings (GO-2026-6617/6613/6612/6611/6608/6603/6600/6599) are gone. Only remaining: GO-2026-5932 — x/crypto/openpgp unmaintained, module-level only, no fixed version available, and our code does not call it.

fen added 1 commit 2026-10-16 21:45:45 +00:00

Bump Go toolchain to 1.27.2 and x/crypto to v0.58.0

CI / docker (pull_request) Skipped

Details

CI / test (pull_request) Successful in 37s

Details

a67c8fd140

Clears 9 reachable stdlib govulncheck findings (all fixed in go1.27.2).
Remaining: GO-2026-5932 (x/crypto/openpgp, module-level only, no fix
available; our code does not call it).

fen commented

2026-10-16 21:50:58 +00:00

Evidence — govulncheck before/after:

BEFORE (go 1.27.1, x/crypto v0.39.0): 9 reachable stdlib vulnerabilities (GO-2026-6617, 6613, 6612, 6611, 6608, 6603, 6600, 6599), all fixed in go1.27.2.

AFTER (go 1.27.2, x/crypto v0.58.0): "Your code is affected by 0 vulnerabilities." 0 reachable, 0 in imported packages. Module-level only: GO-2026-5932 (x/crypto/openpgp unmaintained; no fixed version available; our code does not call it).

Verification: go build ./... ok; go test ./... all packages ok (api, lang, store, web); CI run #437 on this PR completed successfully (37s). Files touched: go.mod, go.sum, Dockerfile only.

Evidence — govulncheck before/after: BEFORE (go 1.27.1, x/crypto v0.39.0): 9 reachable stdlib vulnerabilities (GO-2026-6617, 6613, 6612, 6611, 6608, 6603, 6600, 6599), all fixed in go1.27.2. AFTER (go 1.27.2, x/crypto v0.58.0): "Your code is affected by 0 vulnerabilities." 0 reachable, 0 in imported packages. Module-level only: GO-2026-5932 (x/crypto/openpgp unmaintained; no fixed version available; our code does not call it). Verification: go build ./... ok; go test ./... all packages ok (api, lang, store, web); CI run #437 on this PR completed successfully (37s). Files touched: go.mod, go.sum, Dockerfile only.

All checks were successful

CI / test (pull_request) Successful in 37s

Details

CI / docker (pull_request) Skipped

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin bump-go-toolchain:bump-go-toolchain

git checkout bump-go-toolchain

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: poslop/palette#306