Repository navigation
build: move to Go 1.27, pin Vitess v0.23.5, bump gRPC to v1.83.2 - #172
Merged
Merged
Conversation
Supersedes #162, which bumped go.mod without regenerating go.sum. Toolchain - go directive 1.27.1 (root) and 1.27 (modules/vecindex); go.sum regenerated - release.yml: setup-go 1.27.x with check-latest, actions/checkout v3 -> v4 - example Dockerfiles: golang:1.27-bookworm - drop GOEXPERIMENT=greenteagc everywhere: Green Tea GC is the default collector since Go 1.26, so the flag was a no-op Dependencies - vitess.io/vitess: main-branch pseudo-version (2026-02-13) -> v0.23.5. The pseudo-version sorted as v0.10.x and tripped every scanner; it existed only because v0.23.0 failed to compile on Go 1.26, which v0.23.3+ fixed. Marmot imports only sqlparser and go/mysql; the mysqlctl backup code covered by CVE-2026-27969/27965 is not in the dependency graph. - google.golang.org/grpc v1.78.0 -> v1.83.2 and golang.org/x/net v0.50.0 -> v0.58.0: closes GO-2026-4762, GO-2026-6061 and GO-2026-4559, all reachable through the gRPC server path. - gRPC's sharedWriteBuffer default is now true; Marmot never set it. Behaviour - Vitess v0.23.5 rejects a bare '*' outside the leading select-list position, matching MySQL 8.4 select_item_list. The previous pin was looser than MySQL. Added TestMySQLSelectStarPosition to pin parity. Verification: build/vet/gofmt clean on go1.27.1; all unit packages in both modules pass; ./test cluster integration suite passes with MARMOT_RUN_CLUSTER_INTEGRATION_TESTS=1 -p 1; govulncheck reports zero reachable vulnerabilities (24 on master); go mod verify clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014u4bCrv6aSsNKiY6oWuvrt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #162, which bumped
go.modwithout regeneratinggo.sumand failed every CI job.Toolchain
go 1.27.1(root) andgo 1.27(modules/vecindex);go.sumregenerated and verifiedrelease.yml:setup-goon1.27.xwithcheck-latest: true;actions/checkoutv3 → v4golang:1.27-bookwormGOEXPERIMENT=greenteagcremoved from the workflow,build-linux.sh, and Dockerfiles. Green Tea GC has been the default collector since Go 1.26 (internal/buildcfg/exp.gosetsGreenTeaGC: true), so the flag was a no-op.Dependencies
vitess.io/vitessv0.10.3-0.20260213203506-6d6ed6507e0b(main branch)v0.23.5google.golang.org/grpcv1.78.0v1.83.2golang.org/x/net(indirect)v0.50.0v0.58.0Vitess. The main-branch pseudo-version sorted as v0.10.x and tripped every scanner. It existed only because v0.23.0 failed to compile on Go 1.26 (
go/hack/ensure_swiss_map.go: invalid array length -1), which v0.23.3+ fixed. Marmot imports onlygo/vt/sqlparserandgo/mysql; themysqlctlbackup code covered by CVE-2026-27969 / CVE-2026-27965 is not in the dependency graph.gRPC / x/net. These were the reachable issues on master: GO-2026-4762 (auth bypass via
:path), GO-2026-6061, and GO-2026-4559 (HTTP/2 frame panic), all through the gRPC server path. gRPC'ssharedWriteBufferdefault is nowtrue; Marmot never set it.Behaviour change
Vitess v0.23.5 rejects a bare
*outside the leading select-list position (SELECT id, * FROM t). This matches MySQL 8.4'sselect_item_listgrammar exactly; the previous pin was looser than MySQL and upstream has since reverted it on main too.TestMySQLSelectStarPositionpins the parity.Verification
./testcluster integration suite passes (MARMOT_RUN_CLUSTER_INTEGRATION_TESTS=1 -p 1)govulncheckwith the full sqlite tag set: 0 reachable vulnerabilities (24 on master)go mod verifyandgo mod tidy -diffclean in both modulesgo/mysqlhandshake constants unchanged; every gRPC package Marmot imports is byte-identical between v1.78.0 and v1.83.2🤖 Generated with Claude Code
https://claude.ai/code/session_014u4bCrv6aSsNKiY6oWuvrt