Repository navigation
chore(go): upgrade to Go 1.27 and bump lint tooling - #3006
Merged
Merged
Conversation
Raise the go directive to 1.27 and move every Go toolchain the repo uses onto it: devbox.lock (go 1.27.3), the flake (buildGo127Module on a refreshed nixos-unstable that ships go 1.27.3), and CI, which reads the go directive via setup-go. golangci-lint v2.13.2 can't load Go 1.27 export data, so bump it to v2.15.0 and gofumpt to v0.12.0. golangci-lint's requirements pull x/mod, x/sync, and x/tools forward too. Go 1.27's gofmt aligns one table in flakeref_test.go differently than 1.26. A blank line before the long entry makes both versions (and gofumpt) agree. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
4 of 5 tasks
mikeland73
added a commit
that referenced
this pull request
Oct 25, 2026
## Summary Stacked on #3006 (Go 1.27). Updates every direct Go dependency that has a newer release. | Module | Old | New | Notes | | --- | --- | --- | --- | | `github.com/f1bonacc1/process-compose` | v1.116.0 | v1.122.0 | **Security:** fixes Dependabot advisory "Browser DNS rebinding lets websites control local process-compose MCP tools" (< 1.120.0). Bumps the library and `processComposeVersion` together, as `TestProcessComposeVersionMatchesGoMod` requires. | | `github.com/getsentry/sentry-go` | v0.36.2 | v0.50.0 | Builds as-is. None of the breaking changes in 0.37 to 0.50 touch our usage (`CaptureEvent`, `CurrentHub().Recover`, a custom `HTTPTransport`, which keeps us on the legacy transport). Skipped 1.0.0-alpha, which removes the Hub API. | | `github.com/segmentio/analytics-go` | v3.1.0+incompatible | `analytics-go/v3` v3.4.0 | Moves to the proper module path. `Track` and `Context` only gained fields (`direct`, `groupId`), so events already buffered on disk still decode. | | `al.essio.dev/pkg/shellescape` | v1.6.0 | v1.6.1 | | | `github.com/bmatcuk/doublestar/v4` | v4.9.1 | v4.10.3 | | | `github.com/fsnotify/fsnotify` | v1.9.0 | v1.10.1 | | | `github.com/mattn/go-isatty` | v0.0.22 | v0.0.24 | | | `github.com/samber/lo` | v1.52.0 | v1.53.0 | | | `github.com/tailscale/hujson` | 2025-06-05 | 2026-07-27 | | | `golang.org/x/exp` | 2025-10-23 | 2026-10-14 | | | `golang.org/x/term`, `golang.org/x/text` | v0.46 / v0.41 | v0.47 / v0.43 | Indirect, but compiled into the binary | **process-compose code change:** `types.ProcessState.Namespace` is now `types.Namespaces` (`[]string`), because a process can belong to several namespaces. `devbox services ls` renders it with `Namespaces.String()`, which joins the entries with `, ` and falls back to `default`. Its `UnmarshalJSON` still accepts the old single-string form, so `ls` keeps working against a daemon started by an older devbox that is still running. Everything else either has no newer release or is already latest. `survey` and `pkg/errors` are archived, so replacing them is a refactor and out of scope here. ## Test plan - [x] `devbox run lint`: 0 issues - [x] `devbox run test` (`go test -race -cover ./...`): all packages pass - [x] `nix build .` with the updated `vendor-hash` - [x] Manual smoke test in an isolated XDG home: `devbox services up -b` installs process-compose v1.122.0, `devbox services ls` shows the process with namespace `default`, and `devbox services stop` works - [ ] CI 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the repo to Go 1.27. #2974 held
goat 1.26.3 because golangci-lint v1.64.8 panicked on Go 1.27; the repo has since moved to golangci-lint v2, and v2.15.0 handles 1.27 cleanly.godirective (go.mod)1.26.11.27goindevbox.lockbuildGo126ModulebuildGo127Moduleflake.locknixpkgs (nixos-unstable)Why
go 1.27without a patch version: CI'ssetup-goreads the version fromgo.mod, sogo 1.26.1meant release binaries were built with 1.26.1 and missed every 1.26 security patch. A bare1.27resolves to the latest 1.27.x insetup-go, while the Nix build (GOTOOLCHAIN=local) only needs 1.27.0 or newer.Why the blank line in
flakeref_test.go: Go 1.27's gofmt aligns one long table differently from 1.26, and golangci-lint v2.15 and gofumpt v0.12 flag it. A blank line before the very long entry splits the alignment block, so Go 1.26.1 and 1.27.3 gofmt, gofumpt 0.11 and 0.12, and golangci-lint v2.15 all agree.golangci-lint v2.13.2 can't run on Go 1.27 at all: it fails with
export data version 5 is greater than maximum supported version 4.Note: nixpkgs no longer builds
x86_64-darwinbinaries for go 1.27, so thedevbox.lockentry for that platform is gone. This affects Intel-Mac contributors' dev shells, not the devbox binary.The Go module dependency bumps are in a follow-up PR stacked on this one.
Test plan
devbox run lint: 0 issuesdevbox run fmt: no changesdevbox run test(go test -race -cover ./..., go 1.27.3): all packages passnix build .with the newvendor-hash: builds, anddevbox versionruns🤖 Generated with Claude Code