[vishr]

What this changes

Raises the module's Go version from 1.27.0 to 1.27.2, and repins the discovery image's build stage to the current golang:1.27-alpine digest, which is 1.27.2.

Go 1.27.2 fixes two standard library vulnerabilities that govulncheck now reports as reachable from this module:

• GO-2026-6617: HTTP/2 server crash due to an HPACK encoder race in net/http.
• GO-2026-6613: HTTP/1 server connection desynchronization after a 2xx CONNECT response in net/http.

CI installs the version go.mod names (go-version-file: go.mod), so it was building with 1.27.0, and the Check job's govulncheck step fails on any branch (first seen on #220). main last ran CI on 5 October, before these were published, and would fail the same way on its next run.

The discovery image's build stage was pinned to a golang:1.27-alpine digest whose GOLANG_VERSION is 1.27.0, with GOTOOLCHAIN=local. It therefore shipped a binary built with the vulnerable standard library, and would refuse to build once go.mod requires 1.27.2.

CI's golangci-lint moves from v2.13.1 to v2.14.0. The v2.13.1 release binary cannot read the export data Go 1.27.2 writes for the standard library (export data version 5 is greater than maximum supported version 4), so lint failed in typecheck on the first run of this PR. v2.14.0 is the version just check ran with locally.

No issue was filed first.

Closes #

Why this is correct

• govulncheck ./... with Go 1.27.2: "Your code is affected by 0 vulnerabilities." With 1.27.0 (the CI run on fix(services): give managed PostgreSQL a larger shared memory ceiling #220) it reports both IDs above, with traces through discovery.Client.Events, notify.Send and ui.RestoreCursor.
• The new image digest was resolved with docker buildx imagetools inspect golang:1.27-alpine, and its config reports GOLANG_VERSION=1.27.2; the old digest reports 1.27.0.
• docker build -f build/package/onebox-discovery.Dockerfile . succeeds with the new pin.
• go mod tidy makes no further changes.
• Ran: just check (fmt, vet, full go test ./..., generated docs, site build). Not run: the Docker e2e suite locally; CI runs it.

Effect on the safety envelope

None. The CLI and the discovery image are built with a patched standard library; behaviour is unchanged. Building from source now requires Go 1.27.2 or later.

Checklist

• just check passes locally.
• Tests cover the new behaviour, including the failure paths.
• Generated documentation is current (just check verifies this).
• I have accepted the CLA, or will when the bot asks on my first pull request.