build(deps): refresh Go dependencies and patched toolchains

[steipete]

What Problem This Solves

Builds using Go 1.27.1 expose nine reachable standard-library vulnerabilities reported by govulncheck ./....

User Impact

Use Go 1.27.2 for the CLI, Docker build and optional language-helper builds. The documented minimum remains Go 1.27.0 for the CLI and Go 1.26 for the helpers. No database migration or release is included.

Why This Change Was Made

Refresh the preferred toolchains and verified Docker image pins together, along with the available patch/minor updates to x/sys, x/text, x/crypto, terminal ANSI handling and character widths. Keep installation documentation and the Unreleased changelog aligned.

Standalone Staticcheck and Gosec could not read the new compiler export format. Register the existing analyzers as Go tools so they share the compatible, pinned x/tools reader through the module graph. Preserve all analyzer checks and exclusions, and align local and CI commands.

Evidence

The unchanged main revision reproduced nine reachable standard-library findings under Go 1.27.1. The updated candidate reports zero reachable vulnerabilities. On AWS Linux, make check passed, including lint, race tests, 85.5% coverage (85% required), CLI smoke and six-platform snapshot builds. Source-reconciliation tests and all 15 cloud-publisher/documentation tests passed. All three language helpers passed module verification, vulnerability scans and tests under Go 1.27.2.

Independent Codex autoreview passed the complete staged candidate with no actionable P0–P3 findings. Exact-head GitHub Actions passed at 955bf6af76e9b3f2ae3e4507d9f4ad63743ab99a: https://github.com/openclaw/discrawl/actions/runs/38042737788 (including native Windows/macOS and helper jobs); Docker, CodeQL, secret scanning and repair-helper synthetic validation also passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates preferred Go toolchains to 1.27.2, refreshes dependencies, and runs analyzers through the pinned module graph.

Example: Build Discrawl from source with automatic Go toolchain selection.

• Before: The root module prefers Go 1.27.1.
• After: The root module prefers Go 1.27.2 while retaining the Go 1.27.0 minimum.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused, consistent maintenance with successful exact-head validation; behavioral evidence consists of the author's report and CI step metadata.
Proof confidence	🦐 gold shrimp (3/6)	Verified maintainer authorship places this PR outside the external-contributor proof gate; the body reports AWS validation, and exact-head metadata confirms analyzer and built-CLI smoke execution without supplying directly inspected runtime output.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Binaries built with the previous preferred compiler retain reported reachable standard-library vulnerabilities, and standalone analyzers cannot read the newer compiler export format.
Reason: The verified maintainer direction and existing maintenance policy support this focused refresh without additional settings or public contracts.

Merge readiness

✅ Ready for maintainer review

Keep open: this maintainer-authored security maintenance change is absent from current main, preserves existing contracts, and has no actionable findings.

Priority: P2
Reviewed head: 955bf6af76e9b3f2ae3e4507d9f4ad63743ab99a

Before merge

None.

Findings

None.

Agent review details

How this fits together

Module declarations and container pins select build inputs; Makefile and CI commands use them to produce CLI binaries, language helpers, and analysis results.

flowchart TD
  A[Module and image pins] --> B[Go toolchain]
  B --> C[CLI and helper builds]
  A --> D[Pinned analyzer graph]
  D --> E[Local and CI checks]
  C --> F[Release artifacts]

Loading

Technical review

Best possible solution:

Land the compatible compiler and dependency refresh through the existing release process.

Do we have a high-confidence way to reproduce the issue?

The author reports nine reachable findings on Go 1.27.1; current-main pins confirm that compiler preference, but this review did not independently run the vulnerability reproduction.

Is this the best way to solve the issue?

Updating the preferred compiler and sharing a compatible analyzer dependency graph addresses the reported problems while preserving minimum versions and existing checks.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against b30bf685b554.

Provenance checked

• Preferred compiler and source-install documentation keeps the original intent (5f19420: chore(deps): refresh Go toolchain and archive dependencies #194 selected a patched preferred compiler while preserving the supported minimum.)
• Dependency and analyzer maintenance keeps the original intent (a05883a: chore: refresh dependencies and complete release notes #221 refreshed compatible dependencies and analyzer pins while preserving CLI and storage contracts.)
• Enforced deadcode analysis keeps the original intent (e70f3df: ci: add deadcode check #84 required CI to reject deadcode findings.)
• Docker source-smoke compiler keeps the original intent (936e3ad: build(deps): refresh dependencies and prepare 0.15.5 #253 aligned the source-smoke image with the preferred compiler.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned diff changes dependencies, toolchains, analyzer invocation, checksums, and matching documentation; it changes no application source or persisted format. (go.mod:5, 955bf6af76e9)
• Current main still needs the change: GitHub confirms main remains at the supplied base, whose module prefers Go 1.27.1 and has no analyzer tool declarations. (go.mod:5, b30bf685b554)
• Maintainer identity: Although REST author association says CONTRIBUTOR, the repository permission endpoint confirms steipete has admin access, corroborating the supplied maintainer identity.
• Exact-head validation: GitHub job metadata records successful analyzer execution, module verification and tidiness, vulnerability scanning, race tests, CLI smoke, native builds, helper tests, and snapshot builds for the reviewed head. (.github/workflows/ci.yml:60, 955bf6af76e9)
• Established compiler policy: chore(deps): refresh Go toolchain and archive dependencies #194 established a preferred patched compiler while retaining the supported minimum; this PR preserves that arrangement. (go.mod:5, 5f1942000e3e)
• Enforced deadcode gate preserved: ci: add deadcode check #84 introduced the enforced deadcode check; the changed invocation retains its test scope and findings rejection. (.github/workflows/ci.yml:62, e70f3dfd4e19)

Likely related people:

• Peter Steinberger: Raw commit 4c29bb7 adds go.mod:3 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 4c29bb75ef7f; files: go.mod)
• Vincent Koc: Raw commit e70f3df adds .github/workflows/ci.yml:48 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: e70f3dfd4e19; files: .github/workflows/ci.yml)
• Jeffrey (Dongkyu) Kim: Raw commit 6e7e023 adds tools/discrawl-ja/go.mod:3 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 6e7e023e6c36; files: tools/discrawl-ja/go.mod)

Labels

Label changes:

No label changes.

Label justifications:

• P2: Useful security maintenance with no evidence of active exploitation or an urgent broken user workflow.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-10T09:45:00.434Z sha 985886d :: needs maintainer review before merge. :: none
• reviewed 2026-10-10T09:53:14.694Z sha 955bf6a :: needs maintainer review before merge. :: none

Reviewed October 10, 2026, 5:57 AM ET / 09:57 UTC (Revision 3).