Skip to content

[v0.21.x-branch] Backport #11200: build: bump Go language to 1.26.8 and toolchain to 1.27.1 - #11210

Open
ziggie1984 wants to merge 4 commits into
v0.21.x-branchfrom
backport-11200-to-v0.21.x-branch
Open

ziggie1984 wants to merge 4 commits into
v0.21.x-branchfrom
backport-11200-to-v0.21.x-branch

Conversation

@ziggie1984

Copy link
Copy Markdown
Collaborator

Backport of #11200.


This backports the Go language bump to 1.26.8, the toolchain bump to 1.27.1, regenerated RPC bindings, and the focused golangci-lint v2.13 checks to v0.21.x-branch.

Backport notes:

  • Preserved the parent PR's four-commit structure.
  • Regenerated RPC bindings from the v0.21 schemas with the Go 1.27.1 generator.
  • Kept master-only files that are absent from v0.21 absent.
  • Adapted the doc-comment fixes to the v0.21 harness layout.

Verification:

  • make check-go-version
  • all tracked go.mod files declare Go 1.26.8
  • cd tools && go mod tidy -diff && go mod verify
  • make rpc produces no tracked diff
  • ./scripts/check-rest-annotations.sh from lnrpc
  • go test -run '^$' ./...
  • go test ./lnwire
  • go test ./lnrpc/...
  • custom golangci-lint v2.13.2: 0 issues

Keep lnd compatible with the previous stable Go release by updating the
language version in every tracked go.mod file to Go 1.26.8.

Move build and release tooling to Go 1.27.1, including CI, Docker images,
the Makefile, protobuf generation, the linter configuration, and mobile
build documentation. Update the installation documentation and official
Linux archive checksums for Go 1.26.8 as well.

(cherry picked from commit b1f9ca6)
Upgrade the custom golangci-lint from v2.4.0 to v2.13.2 because the older
version reports false type-checking errors for generic mutex code when it
runs with Go 1.27. Refresh the tools module dependencies, account for the
renamed exhaustruct_v5 linter, and disable the deprecated gomodguard while
leaving gomodguard_v2 active.

Apply Go 1.27's gofmt output to the PSBT test's composite-literal return.

Lower the consecutive-SCID zlib test boundary from 30,794 to 30,792. Go
1.27 changed compress/flate output, making 30,793 SCIDs exceed the
65,535-byte Lightning message limit while 30,792 still fit.

(cherry picked from commit 6b54a38)
The protobuf generator uses Go's formatting packages and is now compiled
inside the Go 1.27.1 Docker image. This changes generated doc-comment
formatting and causes rpc-check to report stale checked-in bindings.

Regenerate the RPC bindings with the newly pinned image. The resulting
changes affect comments only; protobuf schemas and generated API code stay
unchanged.

(cherry picked from commit dd52310)
The linter configuration uses default: all, so upgrading golangci-lint also
enables checks introduced after v2.4. Adopt canonicalheader, clickhouselint,
godoclint, iotamixing, and unqueryvet because they add focused HTTP,
documentation, const-block, and SQL safeguards.

Fix the canonical WebSocket protocol header spelling required by the expanded
canonicalheader implementation. Update twelve existing doc comments to begin
with their declared symbol names as required by godoclint.

Keep modernize disabled for now because its findings require broader code
changes that should be reviewed separately against the Go 1.26 support
baseline.

(cherry picked from commit bada7ea)
@ziggie1984
ziggie1984 force-pushed the backport-11200-to-v0.21.x-branch branch from a0240a4 to 4a4cdb8 Compare September 19, 2026 12:14
@github-actions github-actions Bot added the severity-critical Requires expert review - security/consensus critical label Sep 19, 2026
@github-actions

Copy link
Copy Markdown

🔴 PR Severity: CRITICAL

Automatic classification | 68 files | 9,377 lines changed

🔴 Critical (4 files)
  • contractcourt/chain_arbitrator.go - on-chain dispute resolution (contractcourt/*)
  • lnwallet/chancloser/rbf_coop_transitions.go - channel closing / wallet operations (lnwallet/*)
  • sweep/fee_bumper.go - output sweeping / fee bumping (sweep/*)
  • sweep/sweeper.go - output sweeping / fee bumping (sweep/*)
🟠 High (28 files)
  • cert/go.mod - auth/security dependency toolchain bump
  • sqldb/go.mod, sqldb/v2/go.mod - database backend toolchain bump
  • lnrpc/lightning.pb.go, lnrpc/lightning_grpc.pb.go and 23 other lnrpc/**/*.pb.go / *_grpc.pb.go files - RPC/API definitions, regenerated by the protoc toolchain bump (auto-generated)
🟡 Medium (12 files)
  • go.mod - root module Go directive/toolchain bump
  • actor/go.mod, clock/go.mod, fn/go.mod, healthcheck/go.mod, kvdb/go.mod, queue/go.mod, ticker/go.mod, tlv/go.mod, tor/go.mod - submodule Go directive/toolchain bumps
  • record/blinded_data.go - minor comment/version reference update
  • zpay32/decode.go - minor comment/version reference update
🟢 Low (24 files)
  • .github/actions/setup-go/action.yml, .github/workflows/govulncheck.yml, .github/workflows/main.yml, .github/workflows/release.yaml - CI toolchain version bump
  • docs/INSTALL.md, mobile/README.md - documentation
  • Dockerfile, dev.Dockerfile, docker/btcd/Dockerfile, lnrpc/Dockerfile, make/builder.Dockerfile, tools/Dockerfile - Docker base image version bumps
  • Makefile, .golangci.yml, tools/.custom-gcl.yml, tools/go.mod, tools/go.sum, tools/linters/go.mod, lnrpc/gen_protos_docker.sh - build tooling
  • itest/lnd_psbt_test.go, lnwire/query_short_chan_ids_test.go, lntest/harness.go, lntest/harness_assertion.go, lntest/node/config.go - test-only changes

Analysis

This is a mechanical Go toolchain bump (Go 1.26.8 / toolchain 1.27.1) backported to the v0.21.x branch. Almost every non-test, non-generated file changes only 1-2 lines (a go/toolchain directive or a version string). Even so, the diff touches 37 non-test/non-generated files and roughly 1,350 lines when regenerated protobuf code is excluded, and it independently touches several packages flagged CRITICAL (contractcourt/*, lnwallet/*, sweep/*). Per the size and multi-critical-package bump rules, this pushes the PR to CRITICAL, despite each individual diff being trivial in isolation. The large overall additions/deletions count is dominated by auto-regenerated lnrpc/*.pb.go files, which are excluded from the size-bump calculation but still classified lnrpc/* (HIGH) by path. Recommend a maintainer sanity-check that the toolchain bump doesn't change build tags, vendoring, or generated code behavior in the flagged critical packages, even though the line-level diffs there are one-line version bumps.


To override, add a severity-override-{critical,high,medium,low} label.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-changelog severity-critical Requires expert review - security/consensus critical

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant