From f09abf96749ede8db0ea226cd4d865196af659da Mon Sep 17 00:00:00 2001 From: Albert Bausili Date: Fri, 9 Oct 2026 14:41:02 +0200 Subject: [PATCH 1/2] ci: build with Go 1.27.2 and take x/net v0.60.0, so the Vulnerability Check passes again --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codspeed.yml | 2 +- .github/workflows/coverage.yml | 2 +- .github/workflows/release.yml | 4 ++-- go.mod | 2 +- go.sum | 4 ++-- internal/integrationtest/testserver/go.mod | 6 +++--- internal/integrationtest/testserver/go.sum | 12 ++++++------ 8 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d3edd70..1fc94cb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.13 @@ -48,7 +48,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" # -v prints every test's verdict, so a job log shows which tests ran # rather than one line per package. The root package takes ~110 s # under -race on a hosted runner; 300 s leaves room for a slow one. @@ -71,7 +71,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" - name: Install govulncheck run: go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 - name: Root module @@ -90,7 +90,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" # The testserver helper imports github.com/goceleris/celeris (pinned in # go.mod). Integration tests spawn it as a subprocess per matrix cell, # then drive loadgen against the live server via the library API. -race diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml index 20b4d81..b0d3220 100644 --- a/.github/workflows/codspeed.yml +++ b/.github/workflows/codspeed.yml @@ -82,7 +82,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" - name: Run benchmarks uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1 with: diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 3a39e14..d1ade3f 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -35,7 +35,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" # No -race here: the Test job in ci.yml already runs the suite under the # race detector. atomic is the covermode that stays correct when the # counted code runs on many goroutines, and -coverpkg=./... credits the diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2925728..9be7caf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -71,7 +71,7 @@ jobs: run: scripts/check-release-stamps.sh "$VERSION" - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" - name: Verify module run: | go mod verify @@ -141,7 +141,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.27.0" + go-version: "1.27.2" - name: Build env: GOOS: ${{ matrix.goos }} diff --git a/go.mod b/go.mod index 6f18bb0..74ade56 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.27.0 require ( github.com/HdrHistogram/hdrhistogram-go v1.3.0 - golang.org/x/net v0.59.0 + golang.org/x/net v0.60.0 ) require golang.org/x/text v0.42.0 // indirect diff --git a/go.sum b/go.sum index d4288af..0587691 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= diff --git a/internal/integrationtest/testserver/go.mod b/internal/integrationtest/testserver/go.mod index d9d6814..3dbd3f4 100644 --- a/internal/integrationtest/testserver/go.mod +++ b/internal/integrationtest/testserver/go.mod @@ -5,7 +5,7 @@ go 1.27.0 require github.com/goceleris/celeris v1.5.11 require ( - golang.org/x/net v0.58.0 // indirect - golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/text v0.42.0 // indirect ) diff --git a/internal/integrationtest/testserver/go.sum b/internal/integrationtest/testserver/go.sum index 1e1ebcd..0772fe3 100644 --- a/internal/integrationtest/testserver/go.sum +++ b/internal/integrationtest/testserver/go.sum @@ -1,8 +1,8 @@ github.com/goceleris/celeris v1.5.11 h1:nrLTkL1ZfwZRXiiYVQe9+cCdbc1DBGoW6IEMlwAGD+0= github.com/goceleris/celeris v1.5.11/go.mod h1:ZzUUuUIf5dO7v22roZAfcICffjxSsibYJujTZpxr2Zo= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= From 06d59417d27a36e8538afa846d4b0b02af211ac6 Mon Sep 17 00:00:00 2001 From: Albert Bausili Date: Fri, 9 Oct 2026 14:43:31 +0200 Subject: [PATCH 2/2] ci(lint): take golangci-lint v2.14, whose typecheck reads Go 1.27.2 export data --- .github/workflows/ci.yml | 2 +- CONTRIBUTING.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1fc94cb..3b81c46 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: go-version: "1.27.2" - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: - version: v2.13 + version: v2.14 # fallbackVersion (what a (devel) build reports) and the README's # download TAG must agree; the Release workflow refuses to tag while # they disagree with the tag. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f3e2718..196b5b3 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -8,8 +8,8 @@ changes are held to the same standard as the engine they measure. ## Prerequisites -- Go **1.27.0** (the version pinned in `go.mod` and in CI) -- [golangci-lint](https://golangci-lint.run/) v2.13+ (the CI pin) +- Go **1.27.0** or newer (the `go.mod` minimum; CI builds with 1.27.2) +- [golangci-lint](https://golangci-lint.run/) v2.14+ (the CI pin) - Linux or macOS. The client itself is portable; the process-CPU sampler and recv-queue probe have Linux implementations and `_other.go` fallbacks.