fix: Bump Go toolchain to 1.27.2 for standard library vulnerabilities

.github/workflows/security.yml

@@ -128,10 +128,25 @@ jobs:
         # not a `go install ...@vX.Y.Z` line in a `run:` block. The weekly
         # gosec-pin-currency.yml workflow is what keeps the pin from rotting —
         # deliberately a separate workflow, see the header comment.
+        #
+        # TEMPORARY (securego/gosec#1771): every gosec release up to v2.29.0 is
+        # built against golang.org/x/tools <= v0.49.0, whose export-data reader
+        # stops at version 4. Go 1.27.2 writes version 5, so a plain install
+        # type-checks nothing ("export data version 5 is greater than maximum
+        # supported version 4") and exits 1. Until a gosec release carries
+        # x/tools >= v0.50.0, build the pinned gosec in a throwaway module with
+        # x/tools raised to v0.50.0, then return to the one-line
+        # `go install ...@${v}`. Keep GOSEC_XTOOLS in sync with the Makefile.
+        env:
+          GOSEC_XTOOLS: v0.50.0
         run: |
           v="$(tr -d '[:space:]' < .gosec-version)"
           printf '%s' "$v" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$' || { echo "invalid .gosec-version: $v (expected vMAJOR.MINOR.PATCH)" >&2; exit 1; }
-          go install "github.com/securego/gosec/v2/cmd/gosec@${v}"
+          build="$(mktemp -d)"
+          cd "$build"
+          go mod init gosec-build
+          go get "github.com/securego/gosec/v2/cmd/gosec@${v}" "golang.org/x/tools@${GOSEC_XTOOLS}"
+          go install github.com/securego/gosec/v2/cmd/gosec
 
       - name: Run gosec
         # Staged write + guarded upload, adapted from govulncheck above

.golangci-lint-version

@@ -1 +1 @@
-v2.13.2
+v2.14.0

Makefile

@@ -142,10 +142,20 @@ ci-tools-tidy-check: ## Verify ci-tools/go.mod and ci-tools/go.sum are tidy
 vulncheck: ## Run govulncheck against the Go vulnerability DB (pinned via ci-tools/go.mod)
 	go tool -modfile=ci-tools/go.mod govulncheck ./...
 
+# TEMPORARY (securego/gosec#1771): gosec releases up to v2.29.0 cannot read Go
+# 1.27.2's export data, so the pinned gosec is built in a throwaway module with
+# golang.org/x/tools raised to GOSEC_XTOOLS. Keep it in sync with security.yml, and
+# return to `go run ...@$$v` once a gosec release carries x/tools >= v0.50.0.
+GOSEC_XTOOLS ?= v0.50.0
+
 gosec: ## Run gosec static security analysis (pinned via .gosec-version)
 	@v="$$(tr -d '[:space:]' < .gosec-version)"; \
 	printf '%s' "$$v" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "invalid .gosec-version: $$v (expected vMAJOR.MINOR.PATCH)" >&2; exit 1; }; \
-	go run "github.com/securego/gosec/v2/cmd/gosec@$$v" -quiet ./...
+	build="$$(mktemp -d)"; trap 'rm -rf "$$build"' EXIT; \
+	( cd "$$build" && go mod init gosec-build >/dev/null 2>&1 && \
+	  go get "github.com/securego/gosec/v2/cmd/gosec@$$v" "golang.org/x/tools@$(GOSEC_XTOOLS)" >/dev/null 2>&1 && \
+	  GOOS="$$(go env GOHOSTOS)" GOARCH="$$(go env GOHOSTARCH)" go build -o "$$build/gosec" github.com/securego/gosec/v2/cmd/gosec ) || { echo "building gosec $$v failed" >&2; exit 1; }; \
+	"$$build/gosec" -quiet ./...
 
 ## Licensing
 # go-licenses is intentionally NOT in ci-tools/go.mod — its tree pulls

ci-tools/README.md

@@ -42,6 +42,12 @@ inherited by anyone importing `github.com/genealogix/glx/go-glx` as a library.
   workflow rather than a job in `security.yml` on purpose — `security.yml` is the
   Code Scanning setup for gosec and govulncheck, and any failing job in it marks
   both tools as "reporting errors" on the tool status page (#1145).
+  **Temporarily** (securego/gosec#1771), CI and `make gosec` build the pinned
+  gosec in a throwaway module with `golang.org/x/tools` raised to `v0.50.0`:
+  gosec releases up to v2.29.0 cannot read the export data Go 1.27.2 writes. That
+  module's `go.mod` is never committed, so the tree above stays out of
+  `dependency-review`. Drop the override once a gosec release carries
+  `x/tools` >= v0.50.0.
 - **go-licenses** stays on a version-pinned
   `go install github.com/google/go-licenses/v2@v2.0.1` in
   `.github/workflows/license-compliance.yml` (and a matching `go run` in

ci-tools/go.mod

@@ -2,7 +2,7 @@ module github.com/genealogix/glx/ci-tools
 
 go 1.27.0
 
-toolchain go1.27.1
+toolchain go1.27.2
 
 tool (
 	github.com/hmarr/codeowners/cmd/codeowners

go.mod

@@ -2,7 +2,7 @@ module github.com/genealogix/glx
 
 go 1.27.0
 
-toolchain go1.27.1
+toolchain go1.27.2
 
 require (
 	github.com/brianvoe/gofakeit/v7 v7.17.1

tools/driftcheck/allowlist.go

@@ -123,8 +123,8 @@ func symbolMatches(e *allowlistEntry, f *finding) bool {
 // splitSymbol divides "Type.Field" into ("Type", "Field"). A bare symbol
 // returns ("", symbol).
 func splitSymbol(symbol string) (owner, name string) {
-	if i := strings.LastIndex(symbol, "."); i >= 0 {
-		return symbol[:i], symbol[i+1:]
+	if before, after, found := strings.CutLast(symbol, "."); found {
+		return before, after
 	}
 
 	return "", symbol