Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

Go 1.27.1 in go.mod and in the Dockerfile's test and build images.
Every module go.mod requires is at its current release; protoc-gen-go
follows protobuf to v1.36.12 and mf.pb.go is regenerated. The standard
library uuid package replaces github.com/google/uuid; FromBytes could
only fail on a length validateUUID already checks, so that call and its
unreachable error are gone. make vulncheck runs govulncheck v1.8.0,
installed with go install at its release commit, in a vulncheck stage
of the Dockerfile; script/check does not run it. The newer go directive
switches on lint checks for strings.SplitSeq and t.Chdir, now used. A
new test pins the bytes of a seeded manifest written by an mfer built
before this change.

Model: opus-5-5

Dockerfile

@@ -25,7 +25,7 @@ RUN go test -timeout 90s -race -cover ./... || \
 # No stage depends on it, so the image build does not run it.
 # golang:1.27.1, 2026-10-06
 FROM golang@sha256:1e93e00a31255c07e9a34c4207f3006e1501730c5323697cee7dfb827fdae44c AS vulncheck
-# govulncheck v1.8.0, pinned to the commit its release tag names.
+# govulncheck v1.8.0, 2026-10-06
 RUN go install golang.org/x/vuln/cmd/govulncheck@709015412431dd2b5b28a53c06c70bc02d49074c
 WORKDIR /src
 COPY go.mod go.sum ./

internal/cli/fetch_test.go

@@ -1451,7 +1451,7 @@ func manifestWithMode(t *testing.T, path string, content []byte, mode uint32) []
 	hash, err := multihash.Encode(digest[:], multihash.SHA2_256)
 	require.NoError(t, err)
 
-	id := uuid.New()
+	id := uuid.NewV4()
 
 	inner, err := proto.Marshal(&mfer.MFFile{
 		Version: mfer.MFFile_VERSION_ONE,

mfer/deserialize_path_test.go

@@ -92,7 +92,7 @@ func TestDeserializeRejectsInvalidEntryPaths(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			id := uuid.New()
+			id := uuid.NewV4()
 			data := wrapInner(t, id, craftInnerBytes(id, tt.path))
 
 			_, err := NewManifestFromReader(bytes.NewReader(data))
@@ -150,7 +150,7 @@ func TestDeserializeRefusesEntriesThatDecodeTooLarge(t *testing.T) {
 			entry = protowire.AppendTag(entry, 303, protowire.BytesType) // MFFilePath.ctime
 			entry = protowire.AppendBytes(entry, nil)
 
-			id := uuid.New()
+			id := uuid.NewV4()
 			inner := protowire.AppendTag(nil, 102, protowire.BytesType) // MFFile.uuid
 			inner = protowire.AppendBytes(inner, id[:])
 
@@ -181,7 +181,7 @@ func TestDeserializeDropsUnknownFields(t *testing.T) {
 	entry = protowire.AppendString(entry, "a")
 	entry = append(entry, unknown...)
 
-	id := uuid.New()
+	id := uuid.NewV4()
 	inner := protowire.AppendTag(nil, 101, protowire.BytesType) // MFFile.files
 	inner = protowire.AppendBytes(inner, entry)
 	inner = protowire.AppendTag(inner, 102, protowire.BytesType) // MFFile.uuid

mfer/serialize.go

@@ -88,7 +88,7 @@ func (m *manifest) generateOuter(ctx context.Context) error {
 	if len(m.fixedUUID) == uuidLength {
 		copy(manifestUUID[:], m.fixedUUID)
 	} else {
-		manifestUUID = uuid.New()
+		manifestUUID = uuid.NewV4()
 	}
 
 	m.pbInner.Uuid = manifestUUID[:]