[reka18]

What this change does

Unblocks CI, and puts the whole repo on one Go version. govulncheck now fails every PR on newly published advisories, with no code change involved.

• Go 1.27.3 everywhere: every go.mod and go.work declares go 1.27.3, and the toolchain lines are gone.
• One source: workflows read the version with go-version-file: go.work, and the go matrix dimension is gone, so nothing else pins a Go version.
• Lint: golangci-lint moves to v2.15.0, which reads Go 1.27, in CI and magefile.go.
• golang.org/x/net to v0.62.0, google.golang.org/grpc to v1.83.2 in transport, sink/gcppubsub, examples/dispatch and e2e. x/net also in cmd/crucible.
• github.com/yuin/goldmark to v1.7.17 in cmd/crucible.

Please check these:

• Every module now requires Go 1.27.3, including the stable state, source and source/kafka, so consumers on anything older can't build them unless their toolchain auto-downloads it. Every module changelog says so, and SECURITY.md and STABILITY.md now match: fixes go to each module's latest release, and raising the Go version is at least a minor release.
• CI now tests one Go version, not two.
• Go 1.27 moves encoding/json to its v2 backend. Decoded values for valid input match in this repo's tests, and all 48 modules test the same with it on and off. A string with invalid UTF-8 encodes differently from Go 1.26, and error text, error types and partly decoded targets can differ. Nothing in the repo depends on those.

Why

Advisory	Where	Fixed in
GO-2026-6809	crypto/x509	go1.26.10, go1.27.3
GO-2026-6617, 6612, 6611, 6603	net/http, x/net	go1.26.9, go1.27.2, x/net v0.60.0
GO-2026-6860	x/net	x/net v0.62.0
GO-2026-6348	grpc	v1.83.1
GO-2026-6443	grpc	v1.83.2
GO-2026-5320	goldmark (cmd/crucible, not in CI's scan)	v1.7.17

The table lists the main findings, not every advisory on the older versions.

Relates to: #229

Evidence

Run locally on GOTOOLCHAIN=go1.27.3:

Command	Result
go run github.com/magefile/mage check	passes (lint, race tests and govulncheck over mage's 13 modules)
go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./... in transport, sink/gcppubsub, examples/dispatch, e2e, cmd/crucible	0 affecting our code

Checklist

• Commits are signed off (git commit -s) per the DCO
• Conventional commit messages (type: subject)
• mage check passes locally (lint + race tests + govulncheck), on GOTOOLCHAIN=go1.27.3
• Tests added/updated for the change: one test fixture's Go line, and the lint pin in magefile.go; no other source change
• Public API changes documented (godoc) and, if applicable, noted for the changelog: no API change; the Go requirement is in every module changelog and in transport's README. telemetry/slog and transport have no changelog.

[reka18]

ACR on this PR

concurrency-discipline and replay-determinism shared one reviewer here, because this PR changes no Go source. Every other dimension had its own.

Dimension	Rounds	Latest round
correctness	1	0 blockers
regression-safety	1	0 blockers
concurrency-discipline	1	0 blockers
replay-determinism	1	0 blockers
api-compatibility	2	0 blockers
missed-context	1	0 blockers
human-readability	3	0 blockers

Blockers, folded in:

• e2e/go.mod was left below transport, which it requires. It's now tidied and on Go 1.26.
• The description didn't say what dropping Go 1.25 covers, and it overstated what a Go 1.25 leg would cost. It now states which modules move, what happens to the other 43, and the real trade-off.

Non-blockers, folded in: a CONTRIBUTING.md note that lint needs Go 1.26, an examples/dispatch changelog entry, a transport README line, and govulncheck on Go 1.27.3 in transport and state, which is clean.

Left as is: toolchain go1.26.4 lines, as in #201.

Found, and outside this PR: concurrent inbound Deliver to one actor is a data race on the base too. It needs its own issue.

Maintainers, the Go 1.25 decision in the description is yours. Everything above this PR in the stack depends on it.

[reka18]

ACR on the Go 1.27.3 revision (AI reviewers, clean context)

The scope changed after the earlier round: the whole repo now moves to Go 1.27.3, CI reads the version from go.work, and golangci-lint moves to v2.15.0. The earlier comment's notes on Go 1.26 no longer apply. All labels were reset and re-reviewed.

Dimension	Latest round
correctness	0 blockers after verify; go-version-file: go.work checked against the pinned setup-go
regression-safety	0 blockers; lint rules unchanged on a seeded fixture, all 48 modules test the same with JSON v2 on and off
api-compatibility	0 blockers after verify
missed-context	0 blockers after verify
human-readability	0 blockers after verify
concurrency-discipline	carried from the earlier round; this revision changes no Go source apart from a test fixture
replay-determinism	carried from the earlier round, with the JSON v2 check above

Blockers, folded in: a leftover toolchain line, docs and comments describing a Go-version matrix, changelogs without the new requirement, SECURITY.md contradicting the new floor, and the description overstating what mage check covers.

Evidence: mage check passes on Go 1.27.3. govulncheck is clean on the five bumped modules it doesn't cover.

Not verified: whether branch protection requires any job name that lost its Go version. ci.yml says only gate is required.