Repository navigation
build: build and test with Go 1.27.3 - #98
Merged
Merged
Conversation
Go 1.27.3 fixes GO-2026-6809 (crypto/x509: distrust compromised intermediate certificates). govulncheck found it in the standard library Ark imports (net/http, through the MCP HTTP transport), not called, but a release built with 1.27.2 ships it. go.mod's go line is the only source of the Go version: CI and the release jobs set Go up from it (go-version-file: 'go.mod'), build.sh builds with the toolchain it names (GOTOOLCHAIN) and verify-dist checks the binaries against it. The notes that name the version follow: staticcheck 2026.2.1 still cannot read Go 1.27.3's export data (checked: "export data version 5 is greater than maximum supported version 4"), so the development version stays pinned; the Renovate guide's examples say 1.27.3. Records of past runs keep the version they ran with. No module dependency changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Build, test and release Ark with Go 1.27.3 instead of 1.27.2.
Why
Go 1.27.3 fixes GO-2026-6809 in
crypto/x509(distrust compromised intermediate certificates).govulncheckreports it in the standard library Ark imports — throughnet/http, used by the MCP HTTP transport (internal/mcp/transport.go) — and finds no call of the vulnerable code. A release built with Go 1.27.2 would still ship it, so the toolchain is updated before v6.8.0.Go 1.27.3 is an official stable release (
go.dev/dl,stable: true, all platforms).Changes
go.mod:go 1.27.2→go 1.27.3. This line is the only source of the Go version:go-version-file: 'go.mod', enforced byrelease_workflow_test.go);.github/release/build.shbuilds the release binaries with the toolchain it names (GOTOOLCHAIN);.github/release/verify-dist.shchecks every binary against it.Makefile,.github/workflows/ci.yml, the label of the staticcheck requirement inrelease_workflow_test.go, the examples indocs/maintenance/renovate.md.export data version 5 is greater than maximum supported version 4).No module dependency changes (
go.sumunchanged).Verification
Locally with
go version go1.27.3 darwin/amd64(the toolchaingo.modnames, fetched by the Go command):make fmt-checkmake lint(vet, all tests, race, staticcheck)make smokemake vulncheck(govulncheck v1.9.0)make hephaestus-checkmake snapshotgo1.27.3make actionlintmake fuzzCI: see the checks on this pull request.
Compatibility
Users are not affected: the release binaries are statically linked and built by the release workflow. Building from source (
go install github.com/magicdrive/ark@main) requires Go 1.27.3 or a Go command that can fetch it (GOTOOLCHAIN=auto, the default).