From bc3470bf1162d54a84e7b03aff043e6669aa76ed Mon Sep 17 00:00:00 2001 From: Benjamin Borbe Date: Tue, 13 Oct 2026 20:31:09 +0000 Subject: [PATCH] update go module dependencies --- CHANGELOG.md | 4 ++++ go.mod | 6 ++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 528cbf4..e35b8b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/). * MINOR version when you add functionality in a backwards-compatible manner, and * PATCH version when you make backwards-compatible bug fixes. +## Unreleased + +- chore: update Go to 1.27.2 + ## v0.50.9 - fix: bump `osv-scanner` to v2.6.0 and `golang.org/x/net` to v0.60.0 so the Linux vulnerability gates stop failing. v2.3.1 pins `golang.org/x/tools` v0.38.0, whose SSA builder aborts with `unexpected expr: *ast.KeyValueExpr` on the promoted-field composite-literal key Go 1.27 permits in the Linux stdlib, so a repo on the old pin passes locally on darwin and fails only in Linux CI. `x/net` v0.58.0 carries `GO-2026-6603/6610/6611/6612/6617`, which fail both `vulncheck` and `trivy`. diff --git a/go.mod b/go.mod index aa72034..3240974 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/bborbe/maintainer -go 1.27.1 +go 1.27.2 require ( github.com/bborbe/cqrs v0.6.10 @@ -109,4 +109,6 @@ require ( sigs.k8s.io/yaml v1.6.0 // indirect ) -exclude sigs.k8s.io/structured-merge-diff/v7 v7.0.0 +exclude ( + sigs.k8s.io/structured-merge-diff/v7 v7.0.0 +)