bump go 1.27 - #13
Open
mzihlmann wants to merge 1 commit into
Open
Conversation
|
Warning Review limit reachedNext included review available in 36 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
mzihlmann
changed the title
mzihlmann
marked this pull request as ready for review
August 31, 2026 11:39
The go directive stays at 1.26.7, so kaniko keeps building on 1.26.7 and is not dragged into the flate encoder change it deferred to its next minor. Only CI moves, setup-go installs 1.27 explicitly instead of reading the version out of go.mod. A toolchain directive would have been the tidier way to say this, and it does work, setup-go picks it up and local builds follow it too. It also breaks the lint job: golangci-lint v2.12.2 is itself built with go 1.26 and refuses a module that targets anything newer, "the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.0)". Pinning in the workflows keeps the module targeting 1.26.7, which golangci-lint accepts, while the compiler that produces the binaries is 1.27. What 1.27 buys a binary whose job is carrying credentials over TLS is the removal of the GODEBUG escape hatches that could put weak crypto back: tlsrsakex, tls3des, tls10server and tlsunsafeekm are gone, so RSA key exchange, 3DES and a TLS 1.0 server cannot be re-enabled from the environment any more. It also brings ML-KEM1024 and ML-DSA in TLS 1.3 and x509, which nothing needs yet but is where azure will go. Two costs. The released binary grows 328K, 9.1M to 9.5M stripped. And 1.27 requires macOS 13, so the darwin builds no longer run on macOS 12, which needs to be in the release notes rather than arriving unannounced. Language features stay gated at 1.26.7 by the go directive, only the standard library comes from 1.27, so nothing here can start depending on 1.27 syntax without breaking the floor deliberately. The flip side is that a local build no longer matches a release artifact unless the developer also runs 1.27.
mzihlmann
force-pushed
the
toolchain-1.27
branch
from
August 31, 2026 11:43
fea0aad to
114d873
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Blocked on golangci-lint, see below. Parked as a draft until that clears, the change itself is four lines.
The
godirective stays at1.26.7, so kaniko keeps building on 1.26.7 and is not dragged into the flate encoder change it deferred to its next minor. Only CI moves,setup-goinstalls 1.27 explicitly instead of reading the version out ofgo.mod.Why not a toolchain directive
That was the first attempt and it works:
setup-gov7 picks uptoolchain go1.27.0fromgo.mod(Setup go version spec 1.27.0,go version go1.27.0), and local builds follow it too, so CI and developers match. It also breaks the lint job.Why the workflow route does not fix that either
Pinning in the workflows keeps the module targeting 1.26.7, which gets past the check above, but golangci-lint still has to type check the 1.27 standard library and cannot:
On the runner it surfaces as the precise cause, 1.27's generic methods, which the standard library itself now uses:
math/rand/v2declares(*Rand) N[Int intType](Int) Int, a method with its own type parameters, and ago/typesfrom 1.26 rejects that outright.crypto/internal/randutilimports it, so everything touching crypto fails to typecheck. There is no configuration that avoids this.No golangci-lint release can do it yet. Every recent tag is built with 1.26 or older:
godirectivego 1.26.0go 1.26.0go 1.26.0go 1.25.0So this waits for a golangci-lint built with 1.27. The alternative is splitting lint onto its own
setup-goat 1.26 while tests and releases run 1.27, which means linting different language semantics than we ship, and permanent CI complexity for a temporary external constraint. Not worth it for a four line change.What 1.27 is for
The removal of the GODEBUG escape hatches that could put weak crypto back:
tlsrsakex,tls3des,tls10serverandtlsunsafeekmare gone, so RSA key exchange, 3DES and a TLS 1.0 server cannot be re-enabled from the environment any more. Also ML-KEM1024 and ML-DSA in TLS 1.3 and x509, which nothing needs yet but is where azure will go. The faster small allocations are irrelevant, we exec, make two round trips and exit.Costs
CGO_ENABLED=0 -ldflags="-s -w"darwin_amd64anddarwin_arm64builds stop running on macOS 12. This belongs in the release notes.Language features stay gated at 1.26.7 by the
godirective, only the standard library comes from 1.27, so nothing here can start depending on 1.27 syntax without breaking the floor deliberately.