Repository navigation
go: move everything to Go 1.27.4 - #1115
Merged
Merged
Conversation
Update the module Go directive and the matching operator builder image to address GO-2026-6859 (HTTP/1 server crash due to a MaxBytesReader header race in net/http), which is reachable and fixed in Go 1.26.11. It fails `make vulncheck`, and so the Vulnerability Check in CI, on every pull request until the toolchain moves.
Builds were already split: fourteen images compiled on Go 1.27.3 and one on
1.27.2, while the module, its tests, the operator image and CI ran 1.26. Put
all of it on the latest release, 1.27.4: the go.mod directive and every
golang:*-trixie builder image.
golangci-lint v2.13.1 cannot read Go 1.27 export data ("export data version 5
is greater than maximum supported version 4"), so it moves to v2.15.0, and
gofumpt to v0.12.0 to match the version golangci-lint now bundles. CI's tools
cache is keyed on the Go version, so it rebuilds them.
The newer errcheck flags the shutdown drain discarding cdsub.Run's error.
Report it instead, except for the cancellation shutdown itself causes and the
zero value read once runAgent has already reported a crash.
Philip Lombardi (plombardi89)
changed the title
Philip Lombardi (plombardi89)
enabled auto-merge
November 11, 2026 17:54
hbc (bcho)
approved these changes
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Vulnerability Check is failing on every pull request with GO-2026-6859 (HTTP/1 server crash due to a MaxBytesReader header race in
net/http), which is reachable from our code and fixed in Go 1.26.11.Rather than take only that patch release, this moves everything to the latest Go, 1.27.4. Builds were already split across versions: fourteen images compiled on Go 1.27.3 and one on 1.27.2, while the module, its tests, the operator image and CI ran 1.26.
What changes
go.mod:go 1.26.10becomesgo 1.27.4.go mod tidy -diffreports no other changes.All 15 Containerfiles now use
golang:1.27.4-trixie(from 1.27.3, 1.27.2 and 1.26.11). The image is published for amd64 and arm64.golangci-lint v2.13.1 → v2.15.0, required. v2.13.1 cannot type-check Go 1.27 code (
export data version 5 is greater than maximum supported version 4), even when built with Go 1.27.gofumpt v0.11.0 → v0.12.0, to match the gofumpt that golangci-lint 2.15 bundles, so
make fmtandmake lintdon't disagree.CI tooling: the tools cache is keyed on
go env GOVERSION(ci.yaml:93), so CI rebuilds these with Go 1.27.4 rather than restoring the old binaries.cmd/gantry: errcheck 1.30, which comes with golangci-lint 2.15, flags the shutdown drain discardingcdSub.Run's error (agent_shutdown.go:72). It is now logged, except for:context.Canceledandcontext.DeadlineExceeded, which is whatRunreturns on every ordinary shutdown (cdsub.go:186-208);runAgenthas already reported a crash (main.go:1091).TestReportCdsubExitcovers each of those cases.Unchanged: the toolchain dev images use their distro's Go and let
GOTOOLCHAIN=autofetch thego.modversion, and the tool versions they install come from the Makefile pins.Testing
All on Go 1.27.4, with golangci-lint v2.15.0 and gofumpt v0.12.0:
make fmt: no changes to any file beyond those in this PR.make lint: 0 issues (golangci-lint and actionlint).make vulncheck:no reachable vulnerability has a final-release fix. GO-2026-6859 is gone; GO-2024-3218 ingo-libp2p-kad-dhtremains, with no fixed release, and does not block, as before.go build ./...andgo vet ./...are clean.CI=1 make test, the full race-detector suite: passes, 187 packages ok.