[Azzurriii]

Description

Upgrades the Go toolchain from 1.25.8 to 1.27.3 and refreshes the golang.org/x/* dependencies to clear the vulnerabilities reported by govulncheck. It also fixes two CI jobs that the upgrade broke or that were already failing.

Changes

Toolchain and dependencies

• go.mod and e2e/go.mod: go 1.27.3.
• golang.org/x/{crypto,net,sys,text,term}, otel, klauspost/compress, testify and related modules bumped, then go mod tidy.
• GO_VERSION in ci.yml and e2e-tests.yml, plus the Dockerfile builder image, set to 1.27.3.
• Docs updated to the new minimum Go version: README.md, INSTALLATION.md, k8s instructions, systemd README.

CI: security scan

• Count only the distinct vulnerabilities whose vulnerable code is actually called:
  jq -n '[inputs | select(.finding.trace[0].function != null) | .finding.osv] | unique | length'
• Remove duplicate stacks, codeFlows and rule tags entries from the SARIF file before upload, so GitHub accepts it.

CI: lint

• golangci/golangci-lint-action@v6 → @v9, with golangci-lint pinned to v2.15.0 instead of latest, so a future major release can't break CI unexpectedly.
• New .golangci.yml in v2 format:
  • The comments, common-false-positives, legacy and std-error-handling exclusion presets, which roughly match v1's built-in exclusions.
  • ST1005 (error strings shouldn't be capitalised) is disabled for now. Changing those strings changes the error messages clients see, so it belongs in its own PR.
  • SA1019 is excluded only for ecdsa.PublicKey.X/.Y (see below).

Fixes for new lint findings (no behaviour change)

• examples/: removed defer natsConn.Drain(). It was deferred before defer natsConn.Close(), so it always ran after Close and immediately returned ErrConnectionClosed, doing nothing.
• pkg/eventconsumer: the keygen goroutines already handle their errors and only need to tell the caller that something failed. The channel now carries struct{} instead of an error that was received and then ignored.
• staticcheck quick fixes: fmt.Fprintf instead of WriteString(fmt.Sprintf(...)), De Morgan's law, and shorter selectors for embedded fields.

crypto/ecdsa.PublicKey.X/.Y deprecation (Go 1.26)

The stdlib now steers people away from the raw coordinates, towards PublicKey.Bytes, ParseUncompressedPublicKey and crypto/ecdh. Those APIs only support NIST curves, and for other curves the stdlib suggests a third-party module. Following that advice:

Location	Curve	Change
pkg/client/kms_signer_test.go	P-256	Compare keys with PublicKey.Equal instead of comparing X/Y
examples/hdwallet/ecdsa	secp256k1	Verify signatures with btcec/v2/ecdsa instead of crypto/ecdsa with raw coordinates
pkg/mpc, pkg/encoding, pkg/ckdutil tests	secp256k1 / Ed25519	Unchanged, lint warning excluded. tss-lib returns ecdsa.PublicKey and its API needs X/Y. The fields are deprecated but not removed, and moving off them means migrating away from tss-lib types, which is out of scope here.

Type of change

• Security fix (dependency / toolchain update)
• CI / build
• Refactor (no functional change)
• New feature
• Breaking change

How has this been tested?

• govulncheck ./...: 0 vulnerabilities in the main module and in e2e (run with -test).
• go build ./..., go vet ./... and go test ./... pass.
• golangci-lint run (v2.15.0, --max-same-issues=0 --max-issues-per-linter=0): 0 issues.
• Re-ran the new jq steps on the SARIF and JSON from the failed CI run:
  • The count step reports 30, matching govulncheck's "Your code is affected by 30 vulnerabilities".
  • The SARIF still has all 68 results, and none contain duplicate entries.

Checklist

• My code follows the style of this project
• I have run the linter and tests locally
• I have updated the documentation where needed
• No new warnings are introduced; the remaining exclusions are documented in .golangci.yml

Notes for reviewers

• e2e/base_test.go:65 already fails go vet because a context cancel function is never called. This PR leaves it alone.
• The govulncheck step still has continue-on-error: true. Results go to the Security tab and don't block CI, as before.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.48.0 ⏵ v0.58.0	+1	+75
	github.com/​stretchr/​testify@​v1.11.1 ⏵ v1.12.1	-6
	golang.org/​x/​term@​v0.40.0 ⏵ v0.47.0	+1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud