Build with Go 1.27.2 and golang.org/x/net v0.60.0

Merged
RO
7d ago
+20-16

The release dry run for v1.8.0 stopped at govulncheck: the code calls 11 standard-library vulnerabilities fixed in Go 1.27.2. They're in net/http and its HTTP/2, crypto/tls, mime/multipart and html/template, which the OAuth callback page uses. golang.org/x/net v0.60.0 carries the matching HTTP/2 fixes. release.yml builds with the Go that go.mod names and runs the same scan, so a tag cut on 1.27.0 would fail the scan, or ship those vulnerabilities if it didn't.

Changes

  • Go toolchain: go.mod keeps go 1.27.0 as the minimum and adds toolchain go1.27.2, as does tests/smoke/go.mod. setup-go (go-version-file: go.mod), mise and the go command build with 1.27.2. .mise.toml moves to 1.27.2.
  • golang.org/x/net: v0.59.0 → v0.60.0.
  • golangci-lint: v2.13.1 → v2.14.0. v2.13.1 can't type-check against Go 1.27.2 (export data version 5 is greater than maximum supported version 4). v2.14.0 can, and reports 0 issues. The workflow pins, the pre-commit rev, make tools, the floor in scripts/check-lint-lockstep.sh and its bats fixtures all move together, as that script asks.
  • Nix vendorHash: updated for the x/net bump.

Why not go 1.27.2

The Nix package builds with nixpkgs' go_1_27 and GOTOOLCHAIN=local. nixpkgs master got 1.27.2 on 2026-10-08, but nixpkgs-unstable, which flake.nix follows, is still on 1.27.1. Raising the go line would break the Nix build until the channel catches up. The toolchain line leaves Nix building as before, still on the 1.27.0 locked in flake.lock. A flake.lock bump once nixpkgs-unstable has 1.27.2 brings the Nix build up to date.

Checks

  • Locally on Go 1.27.2: govulncheck ./... finds 0 affecting vulnerabilities, down from 11. One unfixed advisory in golang.org/x/crypto remains, which the code doesn't call. go test ./... passes, golangci-lint v2.14.0 reports 0 issues, and scripts/check-release-lockstep.sh plus tests/e2e/check_release_lockstep.bats pass.

Summary by cubic

Bumps the Go build to 1.27.2 and golang.org/x/net to v0.60.0 so the release scan stops flagging 11 standard-library vulnerabilities it currently finds. The code calls them in net/http and its HTTP/2, crypto/tls, mime/multipart, and html/template — areas the OAuth callback page uses, so a tag cut on 1.27.0 would fail the scan or ship them.

Details

  • go.mod keeps go 1.27.0 as the minimum and adds toolchain go1.27.2; raising the go line itself would break the Nix build because nixpkgs-unstable still ships 1.27.1.
  • golangci-lint moves to v2.14.0 — v2.13.1 can't type-check against Go 1.27.2.
  • Nix vendorHash is updated for the x/net bump.