From a134bb9243a3c02fa1ddbd6a88edcff8748a482b Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sun, 4 Oct 2026 21:13:03 +0200 Subject: [PATCH] go 1.27.1, which is what CI has been building with The go directive said 1.26.4 while every lane of this repository's CI pinned go-version 1.27.1 -- so the version the module DECLARED and the version it was tested with had not been the same for weeks, and a consumer reading go.mod was told it could build this with a toolchain nothing here exercises. The security case is measured, on a sibling of this module where the pin was still 1.26 (go-images/jpeg2000#28). govulncheck, same code: toolchain in packages imported in modules required go1.26.4 1 10 go1.27.1 0 0 Nothing was CALLED in any case. What 1.26.4 carries is its own standard library: GO-2026-4970 in os, and GO-2026-6218, 6091, 6090, 6089, 6088, 5972, 5942, 5026 and 5856 in stdlib, fixed across 1.26.5 and 1.26.6. govulncheck on THIS module is silent under 1.27.1 -- x/sys is already v0.48.0 here, which is past GO-2026-5024. A patch-level directive, 1.27.1 rather than 1.27, because that is the style this file already used and because the advisories above are patch-level: "1.27" would admit a toolchain that has none of 1.27.1's fixes. go vet, the whole suite, exact 100% coverage and gofmt all pass under 1.27.1, which is the toolchain CI already uses -- so this changes what is declared, not what is tested. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 7837849..35c216a 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/go-pdfkit/render -go 1.26.4 +go 1.27.1 require ( github.com/go-gfx/gfx v0.34.0