The test and builder stages of the Dockerfile move from golang:1.24-bookworm to golang:1.27.2-bookworm, pinned by digest with a dated comment. Go 1.24 has had no security fixes since February 2026, so none of the standard library fixes published since then reached the shipped binary. Go 1.27 is the newest release line, still gets security fixes, and is accepted by the pinned golangci-lint v2.14.0, which is built with Go 1.27.0. The go directive in go.mod moves from 1.24.4 to 1.27.1.
What the diff does not show:
The directive is 1.27.1, not 1.27.2, because the lint image ships Go 1.27.1. A higher directive would make that stage download another Go toolchain during the build, and no hash in the repo pins that download.
The images stay on Debian bookworm because the runtime stage is debian:bookworm-slim, and the binary links against that system's C library through cgo.
Once the module targets Go 1.25 or later, the linter asks for sync.WaitGroup.Go wherever a goroutine is started under a WaitGroup. One test in internal/database changes for that. Nothing else in the code changes.
go mod tidy leaves go.sum as it was.
Judgement call: the issue's check is go version -m on the binary in the built image. I ran it before and after the change rather than adding it as a test, because a test that names a Go version would need editing at every upgrade.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/routewatch/issues/107
The `test` and `builder` stages of the `Dockerfile` move from `golang:1.24-bookworm` to `golang:1.27.2-bookworm`, pinned by digest with a dated comment. Go 1.24 has had no security fixes since February 2026, so none of the standard library fixes published since then reached the shipped binary. Go 1.27 is the newest release line, still gets security fixes, and is accepted by the pinned golangci-lint v2.14.0, which is built with Go 1.27.0. The `go` directive in `go.mod` moves from `1.24.4` to `1.27.1`.
What the diff does not show:
- The directive is `1.27.1`, not `1.27.2`, because the lint image ships Go 1.27.1. A higher directive would make that stage download another Go toolchain during the build, and no hash in the repo pins that download.
- The images stay on Debian bookworm because the runtime stage is `debian:bookworm-slim`, and the binary links against that system's C library through cgo.
- Once the module targets Go 1.25 or later, the linter asks for `sync.WaitGroup.Go` wherever a goroutine is started under a `WaitGroup`. One test in `internal/database` changes for that. Nothing else in the code changes.
- `go mod tidy` leaves `go.sum` as it was.
Judgement call: the issue's check is `go version -m` on the binary in the built image. I ran it before and after the change rather than adding it as a test, because a test that names a Go version would need editing at every upgrade.
Model: opus-5-5
The test and build stages move from golang:1.24-bookworm, a release
line that no longer gets security fixes, to golang:1.27.2-bookworm,
pinned by digest. The go directive in go.mod moves from 1.24.4 to
1.27.1, the Go in the pinned lint image, so no stage downloads another
toolchain. One test starts its goroutine with sync.WaitGroup.Go, which
the linter asks for once the module targets Go 1.25 or later.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #107
The
testandbuilderstages of theDockerfilemove fromgolang:1.24-bookwormtogolang:1.27.2-bookworm, pinned by digest with a dated comment. Go 1.24 has had no security fixes since February 2026, so none of the standard library fixes published since then reached the shipped binary. Go 1.27 is the newest release line, still gets security fixes, and is accepted by the pinned golangci-lint v2.14.0, which is built with Go 1.27.0. Thegodirective ingo.modmoves from1.24.4to1.27.1.What the diff does not show:
1.27.1, not1.27.2, because the lint image ships Go 1.27.1. A higher directive would make that stage download another Go toolchain during the build, and no hash in the repo pins that download.debian:bookworm-slim, and the binary links against that system's C library through cgo.sync.WaitGroup.Gowherever a goroutine is started under aWaitGroup. One test ininternal/databasechanges for that. Nothing else in the code changes.go mod tidyleavesgo.sumas it was.Judgement call: the issue's check is
go version -mon the binary in the built image. I ran it before and after the change rather than adding it as a test, because a test that names a Go version would need editing at every upgrade.Model: opus-5-5
Review passed.
Model: opus-5-5