From 3d363ee29a41bd5dab87346898cb89c8a107a0fa Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:52:34 -0400
Subject: [PATCH] build(go): require Go 1.27.2, so no release builds on a
 vulnerable stdlib

`go 1.27.0` let any 1.27.0 or 1.27.1 toolchain build the agent, and the
binary then carries six HIGH stdlib vulnerabilities fixed in 1.27.2
(GO-2026-6603, 6607, 6608, 6611, 6613, 6617). `codefly publish patch` built
v0.0.40 with a local go1.27.1 and its audit refused the release for exactly
that. Requiring 1.27.2 makes every toolchain switch to it (GOTOOLCHAIN=auto).

ci.yml and releaser.yml read the version from go.mod. The goreleaser-cross
image stays v1.27.1-1: no 1.27.2 image is published on ghcr (newest
v1.27.1-3), and it auto-downloads go1.27.2 when go.mod requires it.

Refs #75

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 146cbde..1e6289a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/codefly-dev/service-generic
 
-go 1.27.0
+go 1.27.2
 
 require (
 	github.com/codefly-dev/core v0.19.4