[PR] chore(deps): bump Go to 1.27 and golang.org/x/* to fix known CVEs [skywalking-eyes]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng opened a new pull request, #287:
URL: https://github.com/apache/skywalking-eyes/pull/287

   Supersedes #286 (thanks @surlymochan for the original x/* bump and CVE analysis). #286 moved `go.mod` to Go 1.26, but merging it would break several things CI doesn't cover. This PR goes straight to Go 1.27 and fixes them all.
   
   ## Why
   
   - `golang.org/x/net` v0.56.0 is affected by the HTTP/2 advisories fixed in v0.60.0: GO-2026-6603, 6610, 6611, 6612, 6617.
   - `golang.org/x/text` v0.39.0 is affected by CVE-2026-56851 (GO-2026-6629, fixed in v0.41.0).
   - Every fixed `x/*` release declares `go 1.26.0`, so the toolchain has to move.
   
   ## Changes
   
   | Area | Change |
   |---|---|
   | `go.mod` | `go 1.27.0`; x/net v0.61.0, x/text v0.43.0, x/crypto v0.58.0, x/sys v0.49.0, x/sync v0.24.0, x/tools v0.52.0, x/mod v0.42.0, x/term v0.47.0 |
   | `action.yml`, `header/action.yml`, `dependency/action.yml` | `setup-go` 1.27. **These were missing from #286.** `actions/setup-go@v6` always exports `GOTOOLCHAIN=local`, so leaving them on 1.25 fails `make install` for every downstream project using the actions: `go: go.mod requires go >= 1.26.0 (running go 1.25.3; GOTOOLCHAIN=local)` |
   | CI workflow, `Dockerfile`, `examples/golang/Dockerfile` | Go 1.27 / `golang:1.27-alpine` / 1.27.2 |
   | `Makefile` | golangci-lint v2.15.0 (built with go1.27). The installer URL moves to `https://golangci-lint.run/install.sh`: the script on golangci-lint's frozen `master` branch matches the new `.sbom.json` checksum entries and fails for every release since v2.12.2 (golangci/golangci-lint#6728) |
   | `.golangci.yml` | goconst 1.10 started checking composite literals by default (74 new findings on unchanged code); `exclude-types: [Call, CompositeLit]` restores the previous scope |
   | `pkg/deps/ruby.go` | `//nolint:gosec` on a read-only `os.Open` of a locally discovered `.gemspec` (new G703 false positive), same style as the existing suppressions |
   | `publish-docker.yaml` | Repin `docker/login-action` to v4.6.0 (`dbcb8138…`). The v4.2.0 SHA is no longer on the [ASF allow-list](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml), and publish-docker has ended in `startup_failure` on `main` since #284. This is the same fix as apache/skywalking-go#257 |
   
   The `go.mod` minimum stays at `1.27.0` so any 1.27.x toolchain can build from source. CI, `golang:1.27-alpine` and `setup-go` all resolve to go1.27.2, so shipped artifacts include the stdlib fixes in that release.
   
   ## Verification (local, Go 1.27, `GOTOOLCHAIN=local`)
   
   - `gofmt`, `go mod tidy -diff`, `go vet ./...`: clean
   - `go test ./...`: all packages pass
   - `make lint` with a fresh install via the new URL: `config verify` OK, 0 issues
   - `make license` (header and dependency self-check): pass
   - `make darwin` (what the composite actions' `make install` runs): OK
   - `docker build .`: OK, image runs
   - `govulncheck ./...`: no x/net or x/text findings. Only the unfixed `x/crypto/openpgp` advisory GO-2026-5932 remains (no fixed version upstream)
   - Every `uses:` is in `actions/*` or on the ASF allow-list
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   
   https://claude.ai/code/session_01Ej1HubxqebgChKygA5TTHP
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] chore(deps): bump Go to 1.27 and golang.org/x/* to fix known CVEs [skywalking-eyes]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng merged PR #287:
URL: https://github.com/apache/skywalking-eyes/pull/287


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org