build: move the Go toolchain to 1.27.1

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: ["1.26.8"]
+        go-version: ["1.27.1"]
 
     steps:
       - uses: actions/checkout@v4
@@ -52,12 +52,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.27.1"
           cache: true
       - uses: golangci/golangci-lint-action@v7
         with:
           version: v2.14.0
-          # Build golangci-lint with the job's Go toolchain (1.26.8). The prebuilt
+          # Build golangci-lint with the job's Go toolchain (1.27.1). The prebuilt
           # release binaries are compiled with an older Go and refuse to lint a
           # module whose toolchain directive targets a newer Go ("the Go language
           # version used to build golangci-lint is lower than the targeted Go
@@ -76,7 +76,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.26.8"
+          go-version: "1.27.1"
           cache: true
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest

CHANGELOG.md

@@ -33,6 +33,9 @@ build toolchain. Both purely additive for consumers.
 
 ### Changed
 
+- **Build toolchain: Go 1.26.8 → Go 1.27.1** (`toolchain` directive and CI).
+  The `go 1.25.0` minimum is unchanged: consumers are unaffected, and the
+  GODEBUG defaults this module's own tests run with stay those of Go 1.25.
 - **Build toolchain: Go 1.26.6 → Go 1.26.8** (`toolchain` directive and CI),
   picking up the 2026-08-28 security release. The `go 1.25.0` language minimum
   is unchanged, so consumers are unaffected. CI now fails if its Go and the

README.md

@@ -45,7 +45,7 @@ backendkit packages that foundation into a single, versioned dependency so every
 ## Requirements
 
 - **Go 1.25** or later to import the module. For building/releasing backendkit
-  itself, use **Go 1.26.8** (pinned via the `toolchain` directive in `go.mod`,
+  itself, use **Go 1.27.1** (pinned via the `toolchain` directive in `go.mod`,
   and checked against CI's Go on every run) so the binary picks up the latest Go
   standard-library security fixes; run `govulncheck ./...` to verify. Go 1.25
   itself is out of support since Go 1.27's release — consumers should build with

go.mod

@@ -7,7 +7,7 @@ go 1.25.0
 // The go directive above stays at 1.25.0 so the module remains importable by
 // consumers on Go 1.25; this toolchain directive only governs builds where
 // backendkit is the main module. Keep it equal to the Go version in CI.
-toolchain go1.26.8
+toolchain go1.27.1
 
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1