diff --git a/.golangci-lint-version b/.golangci-lint-version
index a63479186f0..c757c9824bf 100644
--- a/.golangci-lint-version
+++ b/.golangci-lint-version
@@ -1 +1 @@
-v2.11.4
+v2.13.0
diff --git a/.golangci.yaml b/.golangci.yaml
index 1bba9776619..4d5483965eb 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -7,6 +7,7 @@ linters:
     - cyclop           #
     - err113           # will re-add later (another-rex)
     - exhaustruct      # overkill (g-rath)
+    - exhaustruct_v5   # overkill
     - forcetypeassert  # too hard (g-rath)
     - funlen           #
     - funcorder        #
diff --git a/AGENTS.md b/AGENTS.md
index 122425c98bb..de43f30d87b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -40,7 +40,7 @@ You are acting as an AI contributor to the OSV project.
 
 Before requesting review, ensure these pass:
 
-- **Linting:** Run `./scripts/run_lints.sh` and resolve all warnings and errors. If you run into a toolchain error about go being tool old. Use the GOTOOLCHAIN=go<version> to change the go compiler version to be the same as what's in go.mod. Example `GOTOOLCHAIN=go1.26.4 ./scripts/run_lints.sh`
+- **Linting:** Run `./scripts/run_lints.sh` and resolve all warnings and errors. If you run into a toolchain error about go being tool old. Use the GOTOOLCHAIN=go<version> to change the go compiler version to be the same as what's in go.mod. Example `GOTOOLCHAIN=go1.27.0 ./scripts/run_lints.sh`
 - **Tests:** Run `make test` and ensure all tests pass.
 
 ### 4.2 Testing Standards
diff --git a/Dockerfile b/Dockerfile
index 6198bd53856..6830b1f18b6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406 AS builder
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395 AS builder
 
 WORKDIR /src
 COPY ./go.mod ./go.sum ./
diff --git a/action.dockerfile b/action.dockerfile
index 250fa3ab6d7..c3ab4a0d927 100644
--- a/action.dockerfile
+++ b/action.dockerfile
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # WARNING, this workflow is for legacy purposes. To view the current workflow see: https://github.com/google/osv-scanner-action
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 
 RUN mkdir /src
 WORKDIR /src
diff --git a/cmd/osv-reporter/main.go b/cmd/osv-reporter/main.go
index dce6152d69b..231ec98f98f 100644
--- a/cmd/osv-reporter/main.go
+++ b/cmd/osv-reporter/main.go
@@ -109,8 +109,8 @@ func run(args []string, stdout, stderr io.Writer) int {
 			var termWidth int
 			var err error
 			if stdoutAsFile, ok := stdout.(*os.File); ok {
-				termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd())) //nolint:gosec // Fd() is safe to convert to int
-				if err != nil {                                          // If output is not a terminal,
+				termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd()))
+				if err != nil { // If output is not a terminal,
 					termWidth = 0
 				}
 			}
diff --git a/cmd/osv-scanner/fix/command.go b/cmd/osv-scanner/fix/command.go
index 356347d78e5..b429aac63f9 100644
--- a/cmd/osv-scanner/fix/command.go
+++ b/cmd/osv-scanner/fix/command.go
@@ -86,7 +86,7 @@ func Command(stdout, _ io.Writer, clientFactories config.ClientFactories) *cli.C
 				Name:  "interactive",
 				Usage: "run in the interactive mode",
 				Action: func(_ context.Context, _ *cli.Command, b bool) error {
-					if b && !term.IsTerminal(int(os.Stdin.Fd())) { //nolint:gosec // Fd() is safe to convert to int
+					if b && !term.IsTerminal(int(os.Stdin.Fd())) {
 						return errors.New("interactive mode only to be run in a terminal")
 					}
 
@@ -218,17 +218,13 @@ func action(ctx context.Context, cmd *cli.Command, stdout io.Writer, clientFacto
 	}
 
 	opts := options.FixVulnsOptions{
-		RemediationOptions: options.RemediationOptions{
-			ResolutionOptions: options.ResolutionOptions{
-				MavenManagement: cmd.Bool("maven-fix-management"),
-			},
-			IgnoreVulns:   cmd.StringSlice("ignore-vulns"),
-			ExplicitVulns: cmd.StringSlice("vulns"),
-			DevDeps:       !cmd.Bool("ignore-dev"),
-			MinSeverity:   cmd.Float64("min-severity"),
-			MaxDepth:      cmd.Int("max-depth"),
-			UpgradeConfig: upgrade.NewConfigFromStrings(cmd.StringSlice("upgrade-config")),
-		},
+		MavenManagement:   cmd.Bool("maven-fix-management"),
+		IgnoreVulns:       cmd.StringSlice("ignore-vulns"),
+		ExplicitVulns:     cmd.StringSlice("vulns"),
+		DevDeps:           !cmd.Bool("ignore-dev"),
+		MinSeverity:       cmd.Float64("min-severity"),
+		MaxDepth:          cmd.Int("max-depth"),
+		UpgradeConfig:     upgrade.NewConfigFromStrings(cmd.StringSlice("upgrade-config")),
 		Manifest:          cmd.String("manifest"),
 		Lockfile:          cmd.String("lockfile"),
 		Strategy:          strategy.Strategy(cmd.String("strategy")),
diff --git a/cmd/osv-scanner/internal/helper/misc.go b/cmd/osv-scanner/internal/helper/misc.go
index 19b7311adce..7e4979e03fc 100644
--- a/cmd/osv-scanner/internal/helper/misc.go
+++ b/cmd/osv-scanner/internal/helper/misc.go
@@ -49,8 +49,8 @@ func PrintResult(stdout, stderr io.Writer, outputPath, format string, diffVulns
 		}
 	} else { // Output might be a terminal
 		if stdoutAsFile, ok := stdout.(*os.File); ok {
-			termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd())) //nolint:gosec // Fd() is safe to convert to int
-			if err != nil {                                          // If output is not a terminal,
+			termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd()))
+			if err != nil { // If output is not a terminal,
 				termWidth = 0
 			}
 		}
diff --git a/cmd/osv-scanner/internal/testcmd/vcr.go b/cmd/osv-scanner/internal/testcmd/vcr.go
index 1ec05afe6d5..3f27c827e48 100644
--- a/cmd/osv-scanner/internal/testcmd/vcr.go
+++ b/cmd/osv-scanner/internal/testcmd/vcr.go
@@ -53,7 +53,7 @@ func (wht withHeadersTripper) RoundTrip(request *http.Request) (*http.Response,
 		request.Header.Set(key, value)
 	}
 
-	return wht.wrapper.Do(request) //nolint:gosec // Safe in tests
+	return wht.wrapper.Do(request)
 }
 
 var _ http.RoundTripper = withHeadersTripper{}
diff --git a/cmd/osv-scanner/mcp/command.go b/cmd/osv-scanner/mcp/command.go
index 9fa95615af9..017ad7c79de 100644
--- a/cmd/osv-scanner/mcp/command.go
+++ b/cmd/osv-scanner/mcp/command.go
@@ -121,9 +121,7 @@ func handleScan(_ context.Context, _ *mcp.CallToolRequest, input *scanVulnerable
 	action := osvscanner.ScannerActions{
 		DirectoryPaths:      input.Paths,
 		ScanLicensesSummary: false,
-		ExperimentalScannerActions: osvscanner.ExperimentalScannerActions{
-			StatsCollector: &statsCollector,
-		},
+		StatsCollector:      &statsCollector,
 		CallAnalysisStates: map[string]bool{
 			"go": true,
 		},
diff --git a/go.mod b/go.mod
index 28469768836..d7b230fac90 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/google/osv-scanner/v2
 
-go 1.26.5
+go 1.27.0
 
 require (
 	charm.land/glamour/v2 v2.0.1
diff --git a/goreleaser-action.dockerfile b/goreleaser-action.dockerfile
index 3c9540a95bf..7b08c077118 100644
--- a/goreleaser-action.dockerfile
+++ b/goreleaser-action.dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 RUN apk --no-cache add \
   ca-certificates \
   git \
diff --git a/goreleaser.dockerfile b/goreleaser.dockerfile
index a4754822a9b..09d98581820 100644
--- a/goreleaser.dockerfile
+++ b/goreleaser.dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 RUN apk add --no-cache \
     ca-certificates \
     git
diff --git a/internal/output/output_result.go b/internal/output/output_result.go
index f205ab8a250..d31d2d49619 100644
--- a/internal/output/output_result.go
+++ b/internal/output/output_result.go
@@ -568,7 +568,7 @@ func getVulnList(vulnMap map[string]VulnResult) []VulnResult {
 // getNextFixVersion finds the next fixed version for a given vulnerability.
 // returns a boolean value indicating whether a fixed version is available.
 func getNextFixVersion(allAffected []*osvschema.Affected, installedVersion string, installedPackage string, ecosystem string) (bool, string) {
-	ecosystemPrefix := strings.Split(ecosystem, ":")[0]
+	ecosystemPrefix, _, _ := strings.Cut(ecosystem, ":")
 	vp, err := semantic.Parse(installedVersion, ecosystemPrefix)
 	if err != nil {
 		return false, VersionUnsupported
@@ -603,7 +603,7 @@ func getNextFixVersion(allAffected []*osvschema.Affected, installedVersion strin
 
 // calculatePackageFixedVersion determines the highest version that resolves the most known vulnerabilities for a package.
 func calculatePackageFixedVersion(ecosystem string, allVulns []VulnResult) string {
-	ecosystemPrefix := strings.Split(ecosystem, ":")[0]
+	ecosystemPrefix, _, _ := strings.Cut(ecosystem, ":")
 	maxFixVersion := ""
 	var vp semantic.Version
 	for _, vuln := range allVulns {
diff --git a/scripts/run_lints.sh b/scripts/run_lints.sh
index 5172b1c93fd..6554a9633dc 100755
--- a/scripts/run_lints.sh
+++ b/scripts/run_lints.sh
@@ -2,5 +2,5 @@
 
 set -ex
 
-export GOTOOLCHAIN="${GOTOOLCHAIN:-go1.26.4}"
+export GOTOOLCHAIN="${GOTOOLCHAIN:-go1.27.0}"
 go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(cat .golangci-lint-version) run ./... "$@"
diff --git a/scripts/test_env.dockerfile b/scripts/test_env.dockerfile
index 17827d369df..258de6b8943 100644
--- a/scripts/test_env.dockerfile
+++ b/scripts/test_env.dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 
 RUN apk --no-cache add \
   npm \