Repository navigation
Upgrade Go to 1.27.3 - #372
Merged
Merged
Conversation
Set the go directive in go.mod to 1.27.3 to fix CVE-2026-111943. CI and release workflows read the Go version from go.mod via setup-go go-version-file, so they build with 1.27.3 after this change.
golangci-lint v1.64.7 is built with go1.24 and refuses to run when go.mod targets go 1.27.3. A v1.64.8 binary built with go1.27.3 reports 50 false typecheck errors because v1 cannot load Go 1.27 packages. - golangci-lint-action v6 -> v9, golangci-lint v1.64.7 -> v2.15.0 - Convert .golangci.yml to the v2 format with `golangci-lint migrate` - Suppress gosec G703 on the os.WriteFile call in cmd/manifest/update_latest_version.go: the path is a string constant
golangci-lint migrate drops run.timeout, and in v2 the default of 0 disables the timeout. Re-add the previous 10m value.
iosmanthus
approved these changes
Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Set the
godirective in the rootgo.modfrom1.24.0to1.27.3to fix CVE-2026-111943.The lint, test, and release workflows use
actions/setup-go@v5withgo-version-file: './go.mod', so they build with Go 1.27.3 after this change.pkg/go.modstays atgo 1.24. The root module references it throughreplace => ./pkg, so the CLI binary's toolchain is set by the rootgo.mod. Raisingpkg/go.modwould require every downstream consumer ofpkgto use Go 1.27.3.Verification
With go1.27.3:
go mod tidy: no changes togo.modorgo.sumbeyond thegolinego build ./...andgo vet ./...passgo test ./...passes for all packages except./scripts, which was not run successfully locally: the sandbox blockedmktempunder/var/folders. It passes in CI on ubuntu, macos, and windows.golangci-lint upgrade
golangci-lint v1.64.7 is built with go1.24 and fails with
the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.27.3). A v1.64.8 binary built locally with go1.27.3 reports 50 falsetypecheckerrors, because v1 cannot load Go 1.27 packages. This PR therefore also:.golangci.ymlto the v2 format withgolangci-lint migrate, then re-addsrun.timeout: 10m, which the tool drops (the v2 default of 0 disables the timeout)//nolint:gosecfor G703 onos.WriteFile("install.sh", ...)incmd/manifest/update_latest_version.go, where the path is a string constantLocally,
golangci-lint config verifypasses andgolangci-lint run ./...reports 0 issues.