Description
just check runs govulncheck against the Go standard library. A local go1.27.1 reports 12 reachable stdlib vulnerabilities fixed in go1.27.2 (two in html/template via the status page renderer), so the gate goes red with no code change. go.mod declares go 1.27.0 with no toolchain line and every setup-go step reads go-version-file: go.mod, so the declared floor is the one lever that keeps the local gate and CI on a patched toolchain. LOOP.md does not yet say this.
Acceptance Criteria
- #1 go.mod and all four tools/* module go.mod files declare go 1.27.2 and module-verify’s tidy diff stays clean
- #2 just vuln reports no standard-library vulnerability on go1.27.2
- #3 LOOP.md records that a Go patch release can turn just check red through just vuln, and that the fix is raising the go directive plus upgrading local Go, never editing the gate
Definition of Done
- #1 just check passes (the full gate; it is what CI enforces)
- #2 just gen leaves no diff (only if a generated artifact’s inputs changed)
- #3 just –fmt –check passes and every new recipe has a # doc comment and a [group(…)]
Implementation Plan
loop18: raise all five Go directives to 1.27.2, tidy only those modules, add the toolchain trap, prove local gate; root owns reviews and landing.
Implementation Notes
loop18: 1 implementation attempt; initial gate blocked by linter compatibility and x/net prerequisites, repaired separately; done after exact composed gate and CI.
Final Summary
Raised all five Go directives to 1.27.2 and documented the patch-release vulnerability trap. Five-module tidy and vulnerability scans passed, with no stdlib findings; unchanged full gate passed on the combined prerequisite candidate and composed landed SHA 7fa4fc3f948cfb75fe849052c5b42fc3212ca33e. Security review passed; sharded CodeRabbit complete with no relevant blockers. Exact-SHA CI and Helm aggregators succeeded (runs 37934443913 and 37934445673). No generated input changes; pre-commit metrics regeneration reported up to date; formatting gate passed.