[ma-tf]

Summary

• Go 1.25.7 → 1.27.2 (CI 1.27.x). 1.26.9 and 1.27.2 both fix the reachable standard-library reports, including GO-2026-6617. 1.27.2 is used because CI installs golangci-lint latest, which is v2.15.0 built with go1.27.0, and lint is clean on that toolchain.
• github.com/lmittmann/tint 1.1.3 → 1.2.1. NewHandler is deprecated in 1.2; the call site now uses NewTextHandler. NOTICE follows the new module version.
• @commitlint/cli and @commitlint/config-conventional → 21.2.3. v21 requires Node.js 22 and prints the input on its own line (--legacy-output restores the old line). The hook does not parse that output. It now runs under set -e, so a failing commitlint fails the commit; the trailing success echo used to hide the status.
• Actions: checkout v7, cache v6, setup-go v7, goreleaser-action v7, codecov-action v7, anchore/sbom-action/download-syft v0.24.3.
• .golangci.yml exhaustive check value map → mapliteral. golangci-lint 2.15 renamed that option and the old value only partially works.

Release notes checked

• Go 1.26 and 1.27 keep the compatibility promise. Go 1.27 drops macOS 12 (Ventura or later), tightens the vet check for %w on a pointer to an error type, and can change a few gofmt alignments. go vet, tests, and gofmt were clean here.
• actions/checkout v5 moves to Node 24, v6 stores credentials outside .git/config, and v7 refuses fork checkouts on pull_request_target and workflow_run. These workflows use push and pull_request only.
• actions/cache v6, setup-go v7, goreleaser-action v7, and codecov-action v6/v7 are Node 24 / ESM updates. The inputs this repo sets are unchanged. setup-go v6 also changed its default module cache key to go.mod; that only invalidates the cache once.
• anchore/sbom-action 0.23/0.24 moves to Node 24 and a single bundle. download-syft still exposes cmd and syft-version. The new run input defaults to download-syft, so the existing step needs no new inputs.
• commitlint 21 drops Node 18 and 20. Conventional types used in this repo still pass.

Left out

• exhaustruct → exhaustruct_v5. Lint still reports 0 issues and prints a deprecation warning. v5 renames exclude to ignore-patterns and changes how wide the check is, so switching it is a lint-behavior change rather than a dependency bump.
• Indirect golang.org/x/text v0.33.0 and golang.org/x/sys v0.40.0. govulncheck lists GO-2026-5970, GO-2026-6629, and GO-2026-5024 (Windows-only) and reports them as not called. They stay indirect.

Verification

• go build ./...
• go vet ./...
• go test -race on the same package set as CI
• golangci-lint 2.15.0: 0 issues (exhaustruct deprecation warning only)
• govulncheck ./...: 0 reachable vulnerabilities
• .husky/commit-msg: conventional message exits 0; a non-conventional message exits 1. Recent subjects on master still pass.
• go generate ./... and docgen produced no diff

  

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️