build(deps): update the Go toolchain to 1.27.2

[scttbnsn]

Go 1.27.2 came out today with 13 standard-library advisories fixed. osv-scanner flags stdlib@1.27.1 from go.mod, so the pre-push qlty gate fails on every branch off dev until the toolchain moves.

What changed

• go.mod toolchain is go1.27.2. The go 1.26.0 line stays.
• The builder image pin in Dockerfile, Dockerfile.armv7 (both stages), Dockerfile.dev and Dockerfile.release is golang:1.27.2-alpine@sha256:85dc1069.... That's the multi-arch index from docker buildx imagetools inspect, and it covers amd64, arm64 and arm/v7.
• Fixtures and comments that name the toolchain follow: the compose/containerd version test, the ClusterFuzzLite Dockerfile and workflow comments, RELEASING.md, SPEC.md, BENCHMARKS.md.
• scripts/ci/go-lint.sh moves golangci-lint from v2.13.2 to v2.14.0. v2.13.2 can't read the export data 1.27.2 writes ("export data version 5 is greater than maximum supported version 4"), so lint fails on typecheck for every package. v2.14.0 with a clean cache reports 0 issues.

docs/design/mldsa-edge-auth.md still says go1.27.1 because that's the toolchain its benchmark numbers were taken on.

Reachability

govulncheck ./... on 1.27.1 reports 10 of the 13 as reachable at symbol level: GO-2026-6603, 6604, 6605, 6607, 6608, 6610, 6611, 6612, 6613 and 6617. On 1.27.2 it reports none. v0.9.24 was built with 1.27.1, so the next release is the fix for these.

Checks

• go build, go vet, go test ./... pass on 1.27.2
• go mod tidy changes nothing beyond the toolchain line
• qlty check --all reports no issues
• all scripts/*-test.sh pass
• full pre-push hook passed

This supersedes #351, which bumps the digest for the 1.27.1 tag.

Changelog

• 🔒 Updated Go toolchain pins and references from 1.27.1 to 1.27.2. The go 1.26.0 directive remains unchanged.
• 🔧 Updated golangci-lint from v2.13.2 to v2.14.0.
• 🔒 The author reports that Go 1.27.2 addresses standard-library advisories found with Go 1.27.1. The author reports that the build, vet, test, lint, and pre-push checks pass.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: CodesWhat/portwing/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0b016e99-3eaa-47a6-9a8b-69e899b5bccc

---

📥 Commits

Reviewing files that changed from the base of the PR and between 3756d93 and a105e42.

---

⛔ Files ignored due to path filters (1)

• CHANGELOG.md is excluded by !CHANGELOG.md

---

📒 Files selected for processing (14)

• .clusterfuzzlite/Dockerfile
• .github/workflows/quality-fuzz-cflite-pr.yml
• BENCHMARKS.md
• Dockerfile
• Dockerfile.armv7
• Dockerfile.dev
• Dockerfile.release
• RELEASING.md
• SPEC.md
• go.mod
• scripts/cflite-config-test.sh
• scripts/ci/go-lint.sh
• scripts/compose-containerd-version-test.sh
• scripts/reusable-ci-config.test.mjs

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

📝 Walkthrough

---

Priority: ⬆️ High

Change: Other

Merge Risk: ⚪ Minimal · up to a105e

The toolchain and lint updates are consistently reflected in the supplied build and CI references, and existing benchmark records retain their original toolchains. No concrete merge-blocking risk is established.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@greptileai Review exact head a105e42b80340ff5720213ee2275745d90fb4123. Review for correctness, security issues, and cross-file regressions.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[biggest-littlest]

Toolchain bump to Go 1.27.2 with the lint pin it needs. All 14 required checks green on a105e42, CodeRabbit reviewed with no actionable comments.

[ALARGECOMPANY]

Toolchain bump to Go 1.27.2 with the lint pin it needs. All 14 required checks green on a105e42, CodeRabbit reviewed with no actionable comments.