From 5a4832c8aadcb2f9da145676a47e5e187e66efcb Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sun, 4 Oct 2026 21:35:27 +0200 Subject: [PATCH] go 1.27.1, which is what CI has been building with The go directive said 1.26.4 while every lane of this repository's CI pins go-version 1.27.1, so the version DECLARED and the version TESTED had not been the same for weeks, and a consumer reading go.mod was told it could build this with a toolchain nothing here exercises. The security case is measured on a sibling whose pin was still 1.26 (go-images/jpeg2000#28). govulncheck, same code: toolchain in packages imported in modules required go1.26.4 1 10 go1.27.1 0 0 Nothing was CALLED in either case. What 1.26.4 carries is its own standard library: GO-2026-4970 in os, and GO-2026-6218, 6091, 6090, 6089, 6088, 5972, 5942, 5026 and 5856 in stdlib, fixed across 1.26.5 and 1.26.6. A patch-level directive, 1.27.1 rather than 1.27, because that is the style this file already used and the advisories above are patch-level: "1.27" would admit a toolchain with none of 1.27.1's fixes. go vet and the whole suite pass under 1.27.1, and 1.27's gofmt wants nothing this tree does not already have -- checked against the toolchain module cache rather than the local go, which another session upgraded from 1.26.4 to 1.27.1 mid-measurement. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 3981f69..471cfbf 100644 --- a/go.mod +++ b/go.mod @@ -1,3 +1,3 @@ module github.com/go-pdfkit/reader -go 1.26.4 +go 1.27.1