[Defilan]

What

Moves Go from 1.27.3 to 1.27.4, the release that fixes GO-2026-6859 (CVE-2026-97054) in net/http. Every Go builder image moves with it, as make check-go-version requires.

Why

The Security workflow has failed on main since #2490 (2026-11-11 05:35Z). govulncheck reports GO-2026-6859 as reachable from this code, and on main any reachable vulnerability fails the job. Pull requests still pass, because they fail only on vulnerabilities they add (#2381). The tracking issue job opened #2498 for it, and the first clean scan of main closes it.

The vulnerability: on an HTTP/1 server, when MaxBytesReader's limit is exceeded, net/http sets Connection: close without synchronization. A handler that reads the request body while it writes response headers can crash the server. It affects Go before 1.26.11 and 1.27.0 through 1.27.3.

Exposure today looks low:

• The only MaxBytesReader in the repo is the router proxy's handleCompletion (internal/router/proxy.go:323). It reads the whole body with io.ReadAll before it writes any header, so it does not do the concurrent read and write the crash needs.
• govulncheck flags the module anyway, because net/http is reachable from every binary.

Released binaries take their Go version from go.mod through goreleaser. Merging this before the next release (#2474) means that release is built with 1.27.4.

Refs #2498

How

1.27.3 becomes 1.27.4 in every file that names it, 16 in all:

• go.mod. No other line changes.
• The builder images: the five root Dockerfiles, test/e2e/stubupstream/Dockerfile and .devcontainer/devcontainer.json. golang:1.27.4 and golang:1.27.4-alpine are both on Docker Hub (published 2026-11-10, amd64 and arm64).
• The docs and comments that name the version: AGENTS.md, CONTRIBUTING.md, README.md, deployment/macos/README.md, docs/minikube-quickstart.md, docs/site/guides/macos-metal.md, and the example versions in scripts/check-go-version.sh and scripts/gate.sh.

Not changed:

• The govulncheck test fixtures under scripts/testdata/govulncheck/. They pin their own versions.
• The Foreman gate and scan presets (golang:1.26 in api/foreman/v1alpha1). They are defaults for gated repos, not builders of this one.
• CHANGELOG.md.

Testing

• govulncheck v1.9.0, the commit security.yml installs, with GOOS=linux GOARCH=amd64:

  • on this branch with Go 1.27.4: affected by 0 vulnerabilities;
  • on main with Go 1.27.3: affected by 1, GO-2026-6859.

  The one vulnerability it lists as imported but not called matches what the failing main run lists.

• make check-go-version: all 8 golang builder images match go.mod's go 1.27.4.

• Gates, under Go 1.27.4:

  • make test passes, with internal/controller in 197 s.
  • make lint-all: 0 issues on darwin and linux, with golangci-lint v2.15.0 built with Go 1.27.4.
  • make test-scripts passes.
  • No generated files changed.

Checklist

• Tests added/updated (none needed: a toolchain bump; the Security workflow on main is the check)
• make test passes locally
• make lint passes locally
• Commit messages follow conventional commits
• All commits are signed off (git commit -s) per DCO
• AI assistance (if any) is disclosed above, per CONTRIBUTING.md
• Documentation updated (if user-facing change)

Assisted-by: Claude Code (Claude Opus 5.5) (traced the failing Security run to GO-2026-6859, made the version bump, checked the router proxy's MaxBytesReader use, and ran govulncheck on both toolchains plus the test and lint gates)
Assisted-by: qwen38-flash-next (unsloth/Qwen3.8-Flash-Next-GGUF UD-Q4_K_XL, generic (llmkube-gufo-rocm-gfx1151) runtime, self-hosted with LLMKube on AMD Strix Halo (Ryzen AI Max, Radeon iGPU); roles: read-only review. Confirmed no 1.27.3 pin was missed and the pinned fixtures and presets were rightly left alone; flagged that an earlier copy of this description called the 16 files the same set #2224 changed, which was wrong and is now corrected)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!