update to go 1.27

.github/workflows/build.yml

@@ -29,7 +29,7 @@ env:
   TEST_CACHE_SCOPE: "test"
   TESTFLAGS: "-v --parallel=6 --timeout=30m"
   GOTESTSUM_FORMAT: "standard-verbose"
-  GO_VERSION: "1.26"
+  GO_VERSION: "1.27"
   GOTESTSUM_VERSION: "v1.13.0"  # same as one in Dockerfile
 
 jobs:

.github/workflows/codeql.yml

@@ -11,7 +11,7 @@ on:
   pull_request:
 
 env:
-  GO_VERSION: "1.26"
+  GO_VERSION: "1.27"
 
 jobs:
   codeql:

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27
 ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.10.0
 

bake/hclparser/expr.go

@@ -52,7 +52,7 @@ func jsonFuncCallsRecursive(exp hcl.Expression) ([]string, error) {
 
 func appendJSONFuncCalls(exp hcl.Expression, m map[string]struct{}) error {
 	v := reflect.ValueOf(exp)
-	if v.Kind() != reflect.Ptr || v.IsNil() {
+	if v.Kind() != reflect.Pointer || v.IsNil() {
 		return errors.Errorf("invalid json expression kind %T %v", exp, v.Kind())
 	}
 	src := v.Elem().FieldByName("src")
@@ -66,7 +66,7 @@ func appendJSONFuncCalls(exp hcl.Expression, m map[string]struct{}) error {
 	if src.IsNil() {
 		return nil
 	}
-	if src.Kind() == reflect.Ptr {
+	if src.Kind() == reflect.Pointer {
 		src = src.Elem()
 	}
 	if src.Kind() != reflect.Struct {

bake/hclparser/gohcl/decode.go

@@ -23,7 +23,7 @@ func (o DecodeOptions) DecodeBody(body hcl.Body, ctx *hcl.EvalContext, val any)
 	o = o.withDefaults()
 
 	rv := reflect.ValueOf(val)
-	if rv.Kind() != reflect.Ptr {
+	if rv.Kind() != reflect.Pointer {
 		panic(fmt.Sprintf("target value must be a pointer, not %s", rv.Type().String()))
 	}
 
@@ -154,7 +154,7 @@ func (o DecodeOptions) decodeBodyToStruct(body hcl.Body, ctx *hcl.EvalContext, v
 			isSlice = true
 			ty = ty.Elem()
 		}
-		if ty.Kind() == reflect.Ptr {
+		if ty.Kind() == reflect.Pointer {
 			isPtr = true
 			ty = ty.Elem()
 		}

bake/hclparser/gohcl/encode.go

@@ -39,7 +39,7 @@ import (
 func EncodeIntoBody(val any, dst *hclwrite.Body) {
 	rv := reflect.ValueOf(val)
 	ty := rv.Type()
-	if ty.Kind() == reflect.Ptr {
+	if ty.Kind() == reflect.Pointer {
 		rv = rv.Elem()
 		ty = rv.Type()
 	}
@@ -63,7 +63,7 @@ func EncodeIntoBody(val any, dst *hclwrite.Body) {
 func EncodeAsBlock(val any, blockType string) *hclwrite.Block {
 	rv := reflect.ValueOf(val)
 	ty := rv.Type()
-	if ty.Kind() == reflect.Ptr {
+	if ty.Kind() == reflect.Pointer {
 		rv = rv.Elem()
 		ty = rv.Type()
 	}
@@ -110,7 +110,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr
 		fieldTy := field.Type
 		fieldVal := rv.Field(fieldIdx)
 
-		if fieldTy.Kind() == reflect.Ptr {
+		if fieldTy.Kind() == reflect.Pointer {
 			fieldTy = fieldTy.Elem()
 			fieldVal = fieldVal.Elem()
 		}
@@ -122,7 +122,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr
 			if !fieldVal.IsValid() {
 				continue // ignore (field value is nil pointer)
 			}
-			if fieldTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
+			if fieldTy.Kind() == reflect.Pointer && fieldVal.IsNil() {
 				continue // ignore
 			}
 			if prevWasBlock {
@@ -163,7 +163,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr
 					if !elemVal.IsValid() {
 						continue // ignore (elem value is nil pointer)
 					}
-					if elemTy.Kind() == reflect.Ptr && elemVal.IsNil() {
+					if elemTy.Kind() == reflect.Pointer && elemVal.IsNil() {
 						continue // ignore
 					}
 					block := EncodeAsBlock(elemVal.Interface(), name)
@@ -177,7 +177,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr
 				if !fieldVal.IsValid() {
 					continue // ignore (field value is nil pointer)
 				}
-				if elemTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
+				if elemTy.Kind() == reflect.Pointer && fieldVal.IsNil() {
 					continue // ignore
 				}
 				block := EncodeAsBlock(fieldVal.Interface(), name)

bake/hclparser/gohcl/schema.go

@@ -25,7 +25,7 @@ import (
 func ImpliedBodySchema(val any) (schema *hcl.BodySchema, partial bool) {
 	ty := reflect.TypeOf(val)
 
-	if ty.Kind() == reflect.Ptr {
+	if ty.Kind() == reflect.Pointer {
 		ty = ty.Elem()
 	}
 
@@ -56,7 +56,7 @@ func ImpliedBodySchema(val any) (schema *hcl.BodySchema, partial bool) {
 			// indicated via a null value, so we don't specify that
 			// the field is required during decoding.
 			required = false
-		case field.Type.Kind() != reflect.Ptr && !optional:
+		case field.Type.Kind() != reflect.Pointer && !optional:
 			required = true
 		default:
 			required = false
@@ -80,7 +80,7 @@ func ImpliedBodySchema(val any) (schema *hcl.BodySchema, partial bool) {
 		if fty.Kind() == reflect.Slice {
 			fty = fty.Elem()
 		}
-		if fty.Kind() == reflect.Ptr {
+		if fty.Kind() == reflect.Pointer {
 			fty = fty.Elem()
 		}
 		if fty.Kind() != reflect.Struct {

bake/hclparser/hclparser.go

@@ -424,7 +424,7 @@ func (p *parser) resolveBlock(block *hcl.Block, target *hcl.BodySchema) (err err
 		outputs = prev
 		ectxs = p.blockEvalCtx[block]
 	} else {
-		if v, ok := reflect.New(t).Interface().(WithEvalContexts); ok {
+		if v, ok := reflect.TypeAssert[WithEvalContexts](reflect.New(t)); ok {
 			ectxs, err = v.GetEvalContexts(p.ectx, block, func(expr hcl.Expression) hcl.Diagnostics {
 				return p.loadDeps(p.ectx, expr, nil, true)
 			})
@@ -603,7 +603,7 @@ func (p *parser) resolveBlockNames(block *hcl.Block) ([]string, error) {
 			return nil, err
 		}
 
-		if v, ok := val.Interface().(WithGetName); ok {
+		if v, ok := reflect.TypeAssert[WithGetName](val); ok {
 			var err error
 			name, err = v.GetName(ectx, block, func(expr hcl.Expression) hcl.Diagnostics {
 				return p.loadDeps(ectx, expr, nil, true)
@@ -952,7 +952,7 @@ func Parse(b hcl.Body, opt Opt, val any) (*ParseMeta, hcl.Diagnostics) {
 
 		vvs := p.blockValues[b]
 		for _, vv := range vvs {
-			if v, ok := vv.Interface().(WithBlockSource); ok {
+			if v, ok := reflect.TypeAssert[WithBlockSource](vv); ok {
 				v.SetBlockSource(b)
 			}
 

bake/hclparser/type_implied.go

@@ -55,7 +55,7 @@ func impliedType(rt reflect.Type, path cty.Path) (cty.Type, error) {
 	}
 
 	switch rt.Kind() {
-	case reflect.Ptr:
+	case reflect.Pointer:
 		return impliedType(rt.Elem(), path)
 
 	// Primitive types

build/build.go

@@ -304,9 +304,9 @@ func warnOnNoOutput(nodes []builder.Node, opts map[string]Options, reqForNodes m
 	var warnNoOutputBuf bytes.Buffer
 	warnNoOutputBuf.WriteString("No output specified ")
 	if len(noOutputTargets) == 1 && noOutputTargets[0] == "default" {
-		warnNoOutputBuf.WriteString(fmt.Sprintf("with %s driver", noMobyDriver.Factory().Name()))
+		fmt.Fprintf(&warnNoOutputBuf, "with %s driver", noMobyDriver.Factory().Name())
 	} else {
-		warnNoOutputBuf.WriteString(fmt.Sprintf("for %s target(s) with %s driver", strings.Join(noOutputTargets, ", "), noMobyDriver.Factory().Name()))
+		fmt.Fprintf(&warnNoOutputBuf, "for %s target(s) with %s driver", strings.Join(noOutputTargets, ", "), noMobyDriver.Factory().Name())
 	}
 	logrus.Warnf("%s. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load", warnNoOutputBuf.String())
 }
@@ -592,8 +592,7 @@ func (e targetAbortError) Unwrap() error {
 
 func wrapResultError(results map[string]any, msg string) error {
 	if err := resultError(results); err != nil {
-		var abortErr targetAbortError
-		if stderrors.As(err, &abortErr) {
+		if _, ok := stderrors.AsType[targetAbortError](err); ok {
 			return err
 		}
 		return targetAbortError{errors.Wrap(err, msg)}
@@ -1637,7 +1636,7 @@ func ReadSourcePolicy() (*spb.Policy, error) {
 		return nil, nil
 	}
 
-	data, err := os.ReadFile(p)
+	data, err := os.ReadFile(p) // #nosec G703 -- the caller intentionally selects the local policy file
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to read policy file")
 	}

build/opt_test.go

@@ -280,7 +280,7 @@ func TestCacheOptions_DerivedVars(t *testing.T) {
 		},
 		{
 			Type: "s3",
-			Attrs: map[string]string{
+			Attrs: map[string]string{ // #nosec G101 -- dummy credentials for the cache option test
 				"region":            "us-west-2",
 				"bucket":            "my_bucket",
 				"name":              "my_image",

cmd/buildx/debug.go

@@ -27,7 +27,7 @@ func setupDebugProfiles(ctx context.Context) (stop func()) {
 
 func setupCPUProfile(ctx context.Context) (stop func()) {
 	if cpuProfile := os.Getenv("BUILDX_CPU_PROFILE"); cpuProfile != "" {
-		f, err := os.Create(cpuProfile)
+		f, err := os.Create(cpuProfile) // #nosec G703 -- the user selects the CPU profile output path
 		if err != nil {
 			bklog.G(ctx).Warn("could not create cpu profile", logrus.WithError(err))
 			return nil
@@ -53,7 +53,7 @@ func setupHeapProfile(ctx context.Context) (stop func()) {
 	if heapProfile := os.Getenv("BUILDX_MEM_PROFILE"); heapProfile != "" {
 		// Memory profile is only created on stop.
 		return func() {
-			f, err := os.Create(heapProfile)
+			f, err := os.Create(heapProfile) // #nosec G703 -- the user selects the heap profile output path
 			if err != nil {
 				bklog.G(ctx).Warn("could not create memory profile", logrus.WithError(err))
 				return

commands/create.go

@@ -94,7 +94,7 @@ func createCmd(dockerCli command.Cli) *cobra.Command {
 		if len(drivers.String()) > 0 {
 			drivers.WriteString(", ")
 		}
-		drivers.WriteString(fmt.Sprintf(`"%s"`, d.Name()))
+		fmt.Fprintf(&drivers, `"%s"`, d.Name())
 	}
 
 	cmd := &cobra.Command{

commands/replay/build.go

@@ -488,7 +488,7 @@ func filterSubjectsByPlatform(subjects []*replay.Subject, platformFilter []strin
 			if !m.Match(sp) {
 				continue
 			}
-			if best < 0 || m.Less(sp, *subjects[best].Descriptor.Platform) {
+			if best < 0 || m.Less(sp, *subjects[best].Descriptor.Platform) { // #nosec G602 -- best is -1 (short-circuited) or an index from range subjects
 				best = j
 			}
 		}

docs/generate.go

@@ -166,7 +166,7 @@ func generateBakeStdlibDocs(filename string) error {
 	}
 
 	newContent := before + "<!---MARKER_STDLIB_START-->\n\n" + table.String() + "\n" + currentContent[end:]
-	return os.WriteFile(filename, []byte(newContent), 0644)
+	return os.WriteFile(filename, []byte(newContent), 0644) // #nosec G703 -- the caller selects the documentation output file
 }
 
 type mdTable struct {

driver/cloud/driver.go

@@ -234,7 +234,7 @@ func (d *Driver) cloudPull(ctx context.Context, imageDescriptor string, platform
 		RegistryToken: token,
 		ServerAddress: hydroRegistryAddr,
 	}
-	authJSON, err := json.Marshal(authConfig)
+	authJSON, err := json.Marshal(authConfig) // #nosec G117 -- the registry authentication API requires serialized credentials
 	if err != nil {
 		return err
 	}

driver/cloud/login.go

@@ -81,7 +81,7 @@ func fetchHubToken(ctx context.Context, registryHostname, hubHost string) (strin
 	}
 	payload.Identifier = username
 	payload.Secret = secret
-	body, err := json.Marshal(payload)
+	body, err := json.Marshal(payload) // #nosec G117 -- the token endpoint requires credentials in the request body
 	if err != nil {
 		return "", errors.Wrap(err, "failed to marshal request body")
 	}

driver/docker-container/driver.go

@@ -536,10 +536,10 @@ func (d *Driver) Client(ctx context.Context, opts ...client.ClientOpt) (*client.
 		return nil, err
 	}
 
-	var counter int64
+	var counter atomic.Int64
 	opts = append([]client.ClientOpt{
 		client.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
-			if atomic.AddInt64(&counter, 1) == 1 {
+			if counter.Add(1) == 1 {
 				return conn, nil
 			}
 			return d.Dial(ctx)

driver/kubernetes/driver.go

@@ -375,8 +375,7 @@ func isTransientConnectionError(err error) bool {
 	}
 
 	// Check for syscall errors (connection refused, connection reset)
-	var syscallErr syscall.Errno
-	if stderrors.As(err, &syscallErr) {
+	if syscallErr, ok := stderrors.AsType[syscall.Errno](err); ok {
 		if syscallErr == syscall.ECONNREFUSED || syscallErr == syscall.ECONNRESET {
 			return true
 		}

hack/dockerfiles/docs.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27
 ARG ALPINE_VERSION=3.23
 
 ARG FORMATS=md,yaml

hack/dockerfiles/govulncheck.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27
 ARG ALPINE_VERSION=3.23
 
 ARG GOVULNCHECK_VERSION=v1.9.0

hack/dockerfiles/lint.Dockerfile

@@ -1,12 +1,12 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27
 ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.10.0
 
-ARG GOLANGCI_LINT_VERSION=v2.8.0
+ARG GOLANGCI_LINT_VERSION=v2.14.0
 ARG GOLANGCI_FROM_SOURCE=true
-ARG GOPLS_VERSION=v0.40.0
+ARG GOPLS_VERSION=v0.50.0
 # GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated simplifyrange unusedfunc unusedvariable
 ARG GOPLS_ANALYZERS="embeddirective fillreturns infertypeargs maprange modernize nonewvars noresultvalues simplifycompositelit simplifyslice unusedparams yield"
 

hack/dockerfiles/vendor.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27
 ARG ALPINE_VERSION=3.23
 
 ARG MODOUTDATED_VERSION=v0.9.0

localstate/migrate.go

@@ -36,7 +36,7 @@ func (ls *LocalState) migration2() error {
 		if info.IsDir() {
 			return nil
 		}
-		dt, err := os.ReadFile(path)
+		dt, err := os.ReadFile(path) // #nosec G122 -- migration reads the user's private Buildx state directory
 		if err != nil {
 			return err
 		}
@@ -48,7 +48,7 @@ func (ls *LocalState) migration2() error {
 		if err != nil {
 			return err
 		}
-		if err := os.WriteFile(path, mdt, 0600); err != nil {
+		if err := os.WriteFile(path, mdt, 0600); err != nil { // #nosec G122 -- migration updates the user's private Buildx state directory
 			return err
 		}
 		return nil

policy/validate_test.go

@@ -35,7 +35,6 @@ func TestNormalizeHTTPHost(t *testing.T) {
 		{"http", "Example.com", "example.com"},
 		{"https", "\u0130.EXAMPLE.COM:443", "xn--i-9bb.example.com"},
 		{"https", "\u00c9XAMPLE.COM", "xn--xample-9ua.com"},
-		{"https", "\x94.EXAMPLE.COM", "xn--zn7c.example.com"},
 		{"https", "EXAMPLE.COM:000443", "example.com"},
 		{"https", "eXaMpLe.CoM:8443", "example.com:8443"},
 		{"https", "example.com:443", "example.com"},
@@ -144,11 +143,11 @@ func TestSourceToInputSingleSource(t *testing.T) {
 		{
 			name: "http-mixed-case-scheme-and-host",
 			src: &gwpb.ResolveSourceMetaResponse{
-				Source: &pb.SourceOp{Identifier: "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag"},
+				Source: &pb.SourceOp{Identifier: "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag"}, // #nosec G101 -- dummy credentials exercise URL normalization
 			},
 			expInput: Input{
 				HTTP: &HTTP{
-					URL:    "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag",
+					URL:    "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag", // #nosec G101 -- expected normalized URL retains the dummy credentials
 					Schema: "http",
 					Host:   "example.com",
 					Path:   "/Case/Path",