[efirs]

Summary

Go 1.24 is end-of-life and the pinned 1.24.2 toolchain carried 53 reachable advisories in the shipped binary (govulncheck -mode=binary), including the ones flagged by the scanner:

CVE	Component	Actual TAG exposure
CVE-2025-68121	crypto/tls session resumption	Not exploitable: TAG never mutates ClientCAs/RootCAs or uses GetConfigForClient
CVE-2026-56857	os.Root on Windows	Not applicable: Windows-only
CVE-2026-39821	x/net/idna Punycode	Not exploitable: upstream host is operator-configured, ASCII hosts skip idna
CVE-2026-78663	HTTP/2 server flow-control double refund	Low: reachable only on TLS listeners, bounded over-buffering
CVE-2026-33186	grpc-go :path without leading slash	Not exploitable: gRPC auth is a metadata token compare, no path-based authz

None were actively exploitable as TAG uses them, but the fixes for two of them only exist in Go ≥ 1.26.9 / 1.27.2, and x/net 0.60.0 requires Go ≥ 1.26, so a toolchain jump is required anyway.

Changes

• Go toolchain 1.24.2 → 1.27.2 (go.mod + all workflow GO_VERSION pins + README prerequisite)
• golang.org/x/net 0.43.0 → 0.60.0
• google.golang.org/grpc 1.72.2 → 1.84.0 (also clears GO-2026-6061, 6348, 6441, 6443)
• go.etcd.io/etcd/client/pkg/v3 3.5.0 → 3.5.33 (last remaining package-level advisory)
• All outdated direct deps to latest: aws-sdk-go-v2 (+ s3, credentials), smithy-go, go-json, gofakes3, prometheus client/model, zerolog, testify, x/sync, protobuf
• ocache/* intentionally left at v1.13.0 (tied to the CAS coordination contract)

Verification

• make build → binary reports go1.27.2
• make lint, make test, make test-integration all pass
• govulncheck -mode=binary ./tag → 0 vulnerabilities (was 53 reachable)
• Dockerfile is unaffected (copies the prebuilt binary onto alpine:3.21)

🤖 Generated with Claude Code

---

Note

Medium Risk
Large toolchain jump and bumps to networking, gRPC, and AWS S3 client stacks can change runtime behavior without any accompanying code edits; risk is mainly regression in proxy/S3 and cluster paths covered by existing tests.

Overview
Upgrades the project from Go 1.24.2 to 1.27.2 and aligns CI/release/benchmark workflows plus the README contributor prerequisite with the new toolchain.

Refreshes go.mod / go.sum with newer direct and indirect modules—notably golang.org/x/net, google.golang.org/grpc, go.etcd.io/etcd/client/pkg/v3, AWS SDK v2/S3, Prometheus, testify, and other libs—while keeping ocache/* at v1.13.0. There are no application source changes; this is toolchain and dependency hygiene (motivated by EOL Go 1.24 and clearing govulncheck findings on the shipped binary).

^{Reviewed by Cursor Bugbot for commit 6eb901f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issue was found.

Summary

Updates TAG’s Go requirement and all five workflow pins to Go 1.27.2.

• TAG builds now use Go 1.27.2 and refreshed Go libraries.

No actionable issues were found in the inspected code. Builds, tests, and vulnerability checks were not run during this review.

_{Reviews (1) · Last reviewed commit: "build: bump Go to 1.27.2 and update depe..." · Reviewed by Greptile}

[efirs]

I have read the CLA Document and I hereby sign the CLA

[efirs]

recheck

[tigrisdata-argocd-bot]

🎉 This PR is included in version 1.22.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀