[itsakashp]

Description

Addresses the Go binary part of #592 (the base image part is in #599).

The released binary is built with Go 1.24, which no longer receives security fixes, and pulls in old golang.org/x/* and klauspost/compress versions. Trivy reports 98 vulnerabilities in the v1.30.0 binary (1 critical, 45 high), 59 of them in the Go standard library.

Changes

Go and dependencies

• go 1.24 → go 1.27 in go.mod. CI and the release workflow use go-version-file: go.mod, so they install the latest 1.27.x patch release.
• golang.org/x/crypto v0.36.0 → v0.58.0
• golang.org/x/net v0.38.0 → v0.61.0
• golang.org/x/sys v0.31.0 → v0.49.0
• golang.org/x/text v0.23.0 → v0.43.0
• github.com/klauspost/compress v1.17.11 → v1.20.3 (CVE-2026-63209, DoS in dictionary processing)

Lint tooling

golangci-lint v1.64.2 cannot lint a module that targets a newer Go version than the one it was built with, so the linter had to move to v2:

• golangci-lint-action approved-v6 → approved-v9, golangci-lint v1.64.2 → v2.14.0
• .golangci.yml migrated to the v2 format with the same linter selection and the existing comments:
  • gofmt and goimports move to the formatters section
  • gosimple is merged into staticcheck in v2. staticcheck is enabled with only the S* checks, so lint coverage stays the same while the rest of staticcheck stays disabled as before
  • typecheck is no longer a linter
  • v1's default exclusions are kept through the exclusions.presets setting

Code changes required by the newer tooling

• config/types.go: newer durationcheck flags dur *= time.Hour in calculateDuration because dur holds a plain count typed as time.Duration. The unit is now selected first and multiplied once. Behavior is unchanged and covered by TestParseDuration / TestParseDurationNegative.
• .golangci.yml: newer goconst flags the Prometheus label names (user, cluster, ...) repeated across metric definitions. These are excluded with ignore-string-values, which keeps goconst active for everything else.
• utils_test.go: Go 1.27's vet printf check (which go test runs) rejects %q with int arguments in TestGetSessionTimeout, so the test fails to build. Switched to %d, which also makes the failure messages readable (%q printed 888 as '͸').

Results

	Trivy findings in the chproxy binary
v1.30.0 (Go 1.24.7)	98 (1 critical, 45 high, 47 medium, 3 low, 2 unknown)
this PR (Go 1.27.3)	1 (unknown severity)

The remaining finding is GO-2026-5932, an advisory that golang.org/x/crypto/openpgp is deprecated. It has no fix, and chproxy does not import that package. govulncheck ./... reports that the code is affected by 0 vulnerabilities.

Pull request type

• Bugfix
• Feature
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no api changes)
• Build related changes
• Documentation content changes
• Other (please describe):

Checklist

• Linter passes correctly (golangci-lint v2.14.0: 0 issues)
• Add tests which fail without the change (if possible)
• All tests passing (go build, go vet and go test ./... with Go 1.27.3)
• Extended the README / documentation, if necessary

Does this introduce a breaking change?

• Yes
• No

There's no change for users of the binary or the Docker image. Building from source now requires Go 1.27.

Further comments

golangci-lint v2.14.0 prints a deprecation warning for gomodguard (replaced by gomodguard_v2). I left it as is to keep this PR focused, and it can be switched in a follow-up.