chore: upgrade to Go 1.27.1 - #338
Merged
Merged
Conversation
Bump the go directive from 1.26.4 to 1.27.1 and run `go mod tidy`, which consolidated the two indirect require blocks into one. No dependency versions changed and go.sum is untouched. Both CI workflows resolve their toolchain via `setup-go: go-version-file: go.mod`, so no workflow changes are needed. The Dockerfile is an alpine runtime image that copies a prebuilt binary, and nothing else in the repo pins a Go version. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
golangci-lint v2.9.0 refuses to run against a module targeting Go
1.27.1: "the Go language version (go1.26) used to build golangci-lint
is lower than the targeted Go version (1.27.1)". v2.13.0 is the first
release whose binaries are built with Go 1.27; this pins v2.13.2.
The newer linter surfaces findings v2.9.0 never ran:
- exhaustruct is deprecated in favor of exhaustruct_v5, so the existing
disable entry no longer matched and the linter came back on (50
findings). Disable both names, following the wsl/wsl_v5 precedent
already in this config. Same for gomodguard -> gomodguard_v2, which
was only emitting a deprecation warning.
- goconst: extract headerContentType/mimeApplicationJSON in request and
objAccounts/objContacts in the manifest test.
- staticcheck QF1012: fmt.Fprintf(&b, ...) over b.WriteString(fmt.Sprintf(...)).
- modernize: errors.AsType[*json.SyntaxError] over errors.As.
- gosec G124: set SameSite on the Clerk session cookie.
Three gosec taint-analysis findings are annotated rather than changed,
each with the reason inline:
- G705 (login.go): the response is mustache-rendered and the sole
interpolation is {{email}}, the escaping form. Verified by rendering
a <script> payload through clerk.getHTML — it comes back as
<script>.
- G703 (login.go): the write target is the user's own XDG config path;
the only caller-influenced part is AMP_STAGE_OVERRIDE, their own env var.
- G702 (trigger.go): the user's own $EDITOR, run locally as themselves.
This line already carried an equivalent nosemgrep justification.
Verified against the official golangci-lint v2.13.2 binary: 0 issues,
no deprecation warnings. go build, go vet and go test all clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
eberle1080
requested review from
a team and
jlimatampersand
and removed request for
a team
September 11, 2026 18:36
jlimatampersand
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the Go toolchain from 1.26.4 to 1.27.1, and golangci-lint from v2.9.0 to v2.13.2 to go with it.
Commits
1.
chore: upgrade to Go 1.27.1— thegodirective ingo.mod.go mod tidyalso consolidated the two indirectrequire (...)blocks into one; no dependency versions changed andgo.sumis untouched.Nothing else pins a Go version: both workflows resolve the toolchain via
actions/setup-gowithgo-version-file: go.mod, theDockerfileis an alpine runtime image that copies a prebuilt binary, and.goreleaser.yamluses the ambient toolchain.2.
ci: upgrade golangci-lint to v2.13.2— required by the bump. v2.9.0 refuses to run against a 1.27 target:v2.13.0 is the first release whose binaries are built with Go 1.27 (checked with
go version -m; v2.12.2 is still go1.26.2). This pins v2.13.2.Lint findings the newer linter surfaced
v2.13.2 runs checks v2.9.0 never did — 61 findings on previously-green code:
exhaustruct_v5goconststaticcheckQF1012fmt.Fprintf(&b, ...)overb.WriteString(fmt.Sprintf(...))modernizeerrors.AsType[*json.SyntaxError]overerrors.AsgosecG124SameSiteon the Clerk session cookiegosectaintThe 50
exhaustruct_v5findings are not new debt:exhaustructwas deprecated and renamed, so the existing disable entry stopped matching and an already-rejected linter came back on. Both names are now disabled, following thewsl/wsl_v5precedent already in this config.gomodguard→gomodguard_v2got the same treatment (it was only emitting a deprecation warning).Reviewer attention: three suppressed gosec findings
These are taint-analysis results with no real fix available. Each carries its reasoning inline:
cmd/login.go) — the response is mustache-rendered and the only interpolation is{{email}}, the escaping form. Verified empirically by rendering a<script>alert(1)</script>payload throughclerk.getHTML: it comes back as<script>.cmd/login.go) — the write target is the user's own XDG config path; the only caller-influenced part isAMP_STAGE_OVERRIDE, an env var they set for themselves.cmd/trigger.go) — the user's own$EDITOR, run locally as themselves. This line already carried an equivalentnosemgrepjustification from Fix build: Go 1.26, golangci-lint v2, dependency and CI updates #312.Verification
Against the official golangci-lint v2.13.2 binary: 0 issues, no deprecation warnings.
go build,go vet,go test,gofmtall clean.task buildsucceeds and./bin/amp versionreportsgo version: go1.27.1.🤖 Generated with Claude Code