[steipete]

Summary

The preferred Go 1.26.8 build toolchain has ten reachable standard-library vulnerability findings, including GO-2026-6809. Move source builds, CI, Docker and release builds to Go 1.27.3 while keeping the documented Go 1.26 minimum and its compatibility test. All three Go module dependencies are already current.

Update golangci-lint to 2.15.0 and check the shutdown errors previously discarded by two stream-proxy tests. Expose dry_run in the unified release workflow so the merged build can be verified without creating tags or publishing. The shared release workflow already uses xcode-27 for its macOS jobs.

Validation

• Baseline govulncheck ./...: ten reachable standard-library findings with Go 1.26.8.
• Go 1.27.3 with govulncheck 1.9.0: no vulnerabilities found.
• Linux Crabbox: coverage, lint, race tests, vet, production build, and CLI version check pass. Coverage: 75.7% overall, 87.2% stream proxy.
• Updated linter initially caught discarded shutdown errors in two tests; explicit assertions and focused tests now pass.
• Exact-head CI and Docker checks required before merge; the unified release dry run will be dispatched on merged main with the existing version 0.3.5.

No release, tag, version bump, or manual deployment.

Final verification

Merged as 4aba46d9ff7e6383ca7d676e2b4f5849ecd3001e. Post-merge main CI, Docker, and docs checks passed.

Release dry run 39912490262 was dispatched with version=0.3.5 and dry_run=true. It stopped in source validation: CHANGELOG.md needs exactly one dated level-two section for 0.3.5; found 0. Version 0.3.5 remains Unreleased. Full release-build verification is therefore held until release preparation supplies its dated changelog. No tags or releases were created.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T06:35:54.517637Z	bc5fe32	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc5fe32a80

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make the newly exposed dry run runnable

When dry_run: true is dispatched with the documented current version 0.3.5, the shared workflow rejects the run before building because its Go CLI dry-run contract requires a dated changelog version, while this commit leaves ## [0.3.5] - Unreleased in CHANGELOG.md. Consequently the advertised post-merge rehearsal cannot verify this commit; prepare the dated version section before forwarding this option or avoid documenting the current unreleased version as runnable.

Useful? React with 👍 / 👎.