Repository navigation
chore: move to Go 1.27.3 and prepare the 1.0.2 release - #306
Merged
Merged
Conversation
The v1.0.1 release workflow failed in the "Validate tagged commit" job.
The govulncheck step found 14 reachable vulnerabilities in the Go
1.27.1 standard library. Go 1.27.2 fixes 13 of them. Go 1.27.3 fixes
GO-2026-6809 in crypto/x509.
This commit raises Go to 1.27.3 in go.mod, in all the workflow files,
in README.md, and in CONTRIBUTING.md.
golangci-lint v2.13.2 cannot read the export data of Go 1.27.3:
export data version 5 is greater than maximum supported version 4
v2.15.0 uses golang.org/x/tools v0.52.0, which reads it. This commit
raises the pin in the Makefile and in the three workflow files.
The Go checksum database records v1.0.1 on 582090e, so the v1.0.1 tag
must not move. The changelog adds 1.0.2 and tells the reader that no
binaries exist for 1.0.1.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR moves the project to Go 1.27.3 and golangci-lint v2.15.0. It also adds the 1.0.2 entry to the changelog.
Why
The v1.0.1 release workflow failed (run 39650461724). The
govulncheckstep in the "Validate tagged commit" job found 14 reachable vulnerabilities in the Go 1.27.1 standard library. The build, release, and Homebrew jobs did not run. No v1.0.1 release exists on GitHub.crypto/x509net/http,net/http/internal/http2crypto/tlsmime/multipartoshtml/templateThe v1.0.1 tag must not move. The Go checksum database records
v1.0.1on582090e. If the tag moves,go install ...@v1.0.1fails with a checksum mismatch. For this reason, the fix ships as 1.0.2.What Changed
go.mod, the seven workflow files,README.md, andCONTRIBUTING.md: Go 1.27.1 → 1.27.3.Makefile,ci.yml,main-branch.yml, andrelease.yml: golangci-lint v2.13.2 → v2.15.0. v2.13.2 cannot read the Go 1.27.3 export data (export data version 5 is greater than maximum supported version 4). v2.15.0 usesgolang.org/x/toolsv0.52.0.CHANGELOG.md: a new[1.0.2] - 2026-10-22section with a Security entry. The 1.0.1 section tells the reader that no binaries exist for 1.0.1.Alternatives
crypto/x509.Validation
make testwith Go 1.27.3: pass.go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...with Go 1.27.3: "Your code is affected by 0 vulnerabilities."golangci-lintv2.15.0run ./...: 0 issues.check-docs): pass.