Repository navigation
fix: Bump Go toolchain to 1.27.2 for standard library vulnerabilities - #1381
Merged
Merged
Conversation
Resolves govulncheck alerts GO-2026-6599, 6600, 6603, 6604, 6605, 6607, 6608, 6609, 6610, 6611, 6612, 6613 and 6617, all in the standard library (net/http, html/template, os, crypto/tls, net/textproto) and fixed in go1.27.2.
Deploying genealogix with
|
| Latest commit: |
634c011
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e4096fc3.genealogix.pages.dev |
| Branch Preview URL: | https://fix-go-1-27-2-stdlib-vulns.genealogix.pages.dev |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
….2 export data
Go 1.27.2 writes export data version 5. golangci-lint v2.13.2 and every
gosec release up to v2.29.0 are built against golang.org/x/tools <= v0.49.0,
which stops at version 4, so both type-checked nothing on this branch and
failed ("export data version 5 is greater than maximum supported version 4").
- Bump .golangci-lint-version to v2.14.0 (x/tools v0.50.0), and replace the
one new modernize finding it reports (strings.CutLast in driftcheck).
- Build the pinned gosec in a throwaway module with x/tools raised to
v0.50.0, in CI and in `make gosec`, until a gosec release carries it
(securego/gosec#1771). The .gosec-version pin is unchanged.
noahbjohnson
enabled auto-merge (squash)
October 9, 2026 21:17
noahbjohnson
approved these changes
Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the
toolchaindirective ingo.modandci-tools/go.modfromgo1.27.1togo1.27.2, which resolves all 13 open govulncheck code-scanning alerts (code-scanning alerts 255 to 267). Every one is a standard-library vulnerability fixed in Go 1.27.2 (and 1.26.9):yieldpreceder)Every workflow uses
go-version-file: go.mod, so CI picks up the new toolchain with no workflow change.golang.org/x/netis already at v0.60.0 (#1379), which covers the x/net side of the HTTP/2 advisories.Verification
With
GOTOOLCHAIN=go1.27.2:go build ./...andgo vet ./...: cleango test ./...: all packages passgovulncheck ./...: "Your code is affected by 0 vulnerabilities."The one remaining module-level finding is GO-2026-5932 (
golang.org/x/crypto/openpgpis deprecated), pulled in indirectly by go-git. It has no fixed version, glx does not call it, and it is not among the open alerts.The Scorecard
CodeReviewIDalert (code-scanning alert 68) is about repository review process and is not addressable in code.