build(deps): refresh Go dependencies and patched toolchains

.github/workflows/ci.yml

@@ -51,21 +51,18 @@ jobs:
 
       - name: Install analyzers
         run: |
-          go install honnef.co/go/tools/cmd/staticcheck@v0.8.1
           go install mvdan.cc/gofumpt@v0.12.0
-          go install github.com/securego/gosec/v2/cmd/gosec@v2.29.0
-          go install golang.org/x/tools/cmd/deadcode@v0.50.0
 
       - name: Vet
         run: go vet ./...
 
       - name: Staticcheck
-        run: '"$(go env GOPATH)/bin/staticcheck" ./...'
+        run: go tool staticcheck ./...
 
       - name: Deadcode
         run: |
           output_file=$(mktemp)
-          "$(go env GOPATH)/bin/deadcode" -test ./... > "$output_file"
+          go tool deadcode -test ./... > "$output_file"
           if [ -s "$output_file" ]; then
             cat "$output_file"
             exit 1
@@ -81,7 +78,7 @@ jobs:
 
       - name: Gosec
         run: |
-          "$(go env GOPATH)/bin/gosec" -exclude=G101,G115,G202,G301,G304 ./...
+          go tool gosec -exclude=G101,G115,G202,G301,G304 ./...
 
   test:
     runs-on: ubuntu-latest
@@ -186,11 +183,8 @@ jobs:
           go mod tidy
           git diff --exit-code -- go.mod go.sum
 
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
-
       - name: Run govulncheck
-        run: '"$(go env GOPATH)/bin/govulncheck" ./...'
+        run: go tool govulncheck ./...
 
   release-check:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Build with Go 1.27.2 to fix nine reachable standard-library vulnerabilities, including in Docker and optional language helpers, while retaining the existing minimum Go versions; refresh Go system, text, cryptography, terminal ANSI, and character-width dependencies, and run analyzers with the compatible module-pinned export reader.
 - Update CodeQL initialization and analysis together to v4.38.2 and group future updates to avoid incompatible action versions; refresh TruffleHog to v3.97.9. Thanks @dependabot.
 - Use one shared autoreview installation from `openclaw/agent-skills`; repository entrypoints now receive upstream fixes without copied helpers or test suites.
 

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32
 
-ARG GO_VERSION=1.27.1
-ARG GO_IMAGE_DIGEST=sha256:4cb7ac979db5fcc41cae44b2227ba5ab8a51e8807f40d9ba4dee20a0ad960b5b
+ARG GO_VERSION=1.27.2
+ARG GO_IMAGE_DIGEST=sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673
 ARG ALPINE_VERSION=3.24
 
 FROM golang:${GO_VERSION}-alpine@${GO_IMAGE_DIGEST} AS build

Makefile

@@ -56,11 +56,11 @@ fmt:
 lint:
 	GOWORK=off go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 run
 	GOWORK=off go vet ./...
-	GOWORK=off go run honnef.co/go/tools/cmd/staticcheck@v0.8.1 ./...
-	GOWORK=off go run github.com/securego/gosec/v2/cmd/gosec@v2.29.0 -exclude=G101,G115,G202,G301,G304 ./...
-	GOWORK=off go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
+	GOWORK=off go tool staticcheck ./...
+	GOWORK=off go tool gosec -exclude=G101,G115,G202,G301,G304 ./...
+	GOWORK=off go tool govulncheck ./...
 	@output_file="$$(mktemp)"; trap 'rm -f "$$output_file"' EXIT; \
-	GOWORK=off go run golang.org/x/tools/cmd/deadcode@v0.50.0 -test ./... >"$$output_file"; \
+	GOWORK=off go tool deadcode -test ./... >"$$output_file"; \
 	if [ -s "$$output_file" ]; then cat "$$output_file"; exit 1; fi
 
 tidy-check:

README.md

@@ -22,7 +22,7 @@ discrawl --version
 
 Windows binaries and signed archives for all supported platforms are available from [GitHub Releases](https://github.com/openclaw/discrawl/releases/latest).
 
-To build from source, install Go 1.27.0 or newer. The module selects Go 1.27.1 as its preferred toolchain:
+To build from source, install Go 1.27.0 or newer. The module selects Go 1.27.2 as its preferred toolchain:
 
 ```bash
 git clone https://github.com/openclaw/discrawl.git

docs/install.md

@@ -27,7 +27,7 @@ Release-check HTTP requests time out after 30 seconds if the server does not res
 
 ## From source
 
-Requires Go `1.27.0+`; the module selects Go `1.27.1` as its preferred toolchain, which Go downloads automatically when needed. CI and the Docker build use this patch release too.
+Requires Go `1.27.0+`; the module selects Go `1.27.2` as its preferred toolchain, which Go downloads automatically when needed. CI and the Docker build use this patch release too.
 
 ```bash
 git clone https://github.com/openclaw/discrawl.git

go.mod

@@ -2,7 +2,7 @@ module github.com/openclaw/discrawl
 
 go 1.27.0
 
-toolchain go1.27.1
+toolchain go1.27.2
 
 require (
 	github.com/alecthomas/kong v1.16.1
@@ -11,42 +11,94 @@ require (
 	github.com/openclaw/crawlkit v0.16.7
 	github.com/stretchr/testify v1.12.1
 	github.com/zalando/go-keyring v0.2.8
-	golang.org/x/sys v0.48.0
-	golang.org/x/text v0.42.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/text v0.43.0
 )
 
 require (
+	cloud.google.com/go v0.123.0 // indirect
+	cloud.google.com/go/auth v0.23.2 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/anthropics/anthropic-sdk-go v1.66.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/buger/jsonparser v1.6.1 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/bubbles v1.0.0 // indirect
 	github.com/charmbracelet/bubbletea v1.3.10 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
 	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.11.8 // indirect
+	github.com/charmbracelet/x/ansi v0.11.9 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/danieljoos/wincred v1.2.3 // indirect
 	github.com/dustin/go-humanize v1.1.0 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
+	github.com/googleapis/gax-go/v2 v2.24.0 // indirect
+	github.com/gookit/color v1.6.1 // indirect
+	github.com/invopop/jsonschema v0.14.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.30 // indirect
+	github.com/mattn/go-runewidth v0.0.31 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/ncruces/go-strftime v1.1.0 // indirect
+	github.com/openai/openai-go/v3 v3.52.0 // indirect
+	github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/securego/gosec/v2 v2.29.0 // indirect
+	github.com/standard-webhooks/standard-webhooks/libraries v0.0.1 // indirect
+	github.com/tidwall/gjson v1.19.0 // indirect
+	github.com/tidwall/match v1.2.0 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/xo/terminfo v1.2.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/crypto v0.57.0 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/telemetry v0.0.0-20260924152758-ed294f943157 // indirect
+	golang.org/x/tools v0.51.0 // indirect
+	golang.org/x/vuln v1.8.0 // indirect
+	google.golang.org/api v0.293.0 // indirect
+	google.golang.org/genai v1.69.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/grpc v1.83.1 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+	honnef.co/go/tools v0.8.1 // indirect
 	modernc.org/libc v1.77.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
 	modernc.org/sqlite v1.60.1 // indirect
 )
+
+tool (
+	github.com/securego/gosec/v2/cmd/gosec
+	golang.org/x/tools/cmd/deadcode
+	golang.org/x/vuln/cmd/govulncheck
+	honnef.co/go/tools/cmd/staticcheck
+)