chore: update golang to v1.27 and golangci-lint to v2.13

.golangci-lint-version

@@ -1 +1 @@
-v2.11.4
+v2.13.0

.golangci.yaml

@@ -7,6 +7,7 @@ linters:
     - cyclop           #
     - err113           # will re-add later (another-rex)
     - exhaustruct      # overkill (g-rath)
+    - exhaustruct_v5   # overkill
     - forcetypeassert  # too hard (g-rath)
     - funlen           #
     - funcorder        #

AGENTS.md

@@ -40,7 +40,7 @@ You are acting as an AI contributor to the OSV project.
 
 Before requesting review, ensure these pass:
 
-- **Linting:** Run `./scripts/run_lints.sh` and resolve all warnings and errors. If you run into a toolchain error about go being tool old. Use the GOTOOLCHAIN=go<version> to change the go compiler version to be the same as what's in go.mod. Example `GOTOOLCHAIN=go1.26.4 ./scripts/run_lints.sh`
+- **Linting:** Run `./scripts/run_lints.sh` and resolve all warnings and errors. If you run into a toolchain error about go being tool old. Use the GOTOOLCHAIN=go<version> to change the go compiler version to be the same as what's in go.mod. Example `GOTOOLCHAIN=go1.27.0 ./scripts/run_lints.sh`
 - **Tests:** Run `make test` and ensure all tests pass.
 
 ### 4.2 Testing Standards

Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406 AS builder
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395 AS builder
 
 WORKDIR /src
 COPY ./go.mod ./go.sum ./

action.dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # WARNING, this workflow is for legacy purposes. To view the current workflow see: https://github.com/google/osv-scanner-action
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 
 RUN mkdir /src
 WORKDIR /src

cmd/osv-reporter/main.go

@@ -109,8 +109,8 @@ func run(args []string, stdout, stderr io.Writer) int {
 			var termWidth int
 			var err error
 			if stdoutAsFile, ok := stdout.(*os.File); ok {
-				termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd())) //nolint:gosec // Fd() is safe to convert to int
-				if err != nil {                                          // If output is not a terminal,
+				termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd()))
+				if err != nil { // If output is not a terminal,
 					termWidth = 0
 				}
 			}

cmd/osv-scanner/fix/command.go

@@ -86,7 +86,7 @@ func Command(stdout, _ io.Writer, clientFactories config.ClientFactories) *cli.C
 				Name:  "interactive",
 				Usage: "run in the interactive mode",
 				Action: func(_ context.Context, _ *cli.Command, b bool) error {
-					if b && !term.IsTerminal(int(os.Stdin.Fd())) { //nolint:gosec // Fd() is safe to convert to int
+					if b && !term.IsTerminal(int(os.Stdin.Fd())) {
 						return errors.New("interactive mode only to be run in a terminal")
 					}
 
@@ -218,17 +218,13 @@ func action(ctx context.Context, cmd *cli.Command, stdout io.Writer, clientFacto
 	}
 
 	opts := options.FixVulnsOptions{
-		RemediationOptions: options.RemediationOptions{
-			ResolutionOptions: options.ResolutionOptions{
-				MavenManagement: cmd.Bool("maven-fix-management"),
-			},
-			IgnoreVulns:   cmd.StringSlice("ignore-vulns"),
-			ExplicitVulns: cmd.StringSlice("vulns"),
-			DevDeps:       !cmd.Bool("ignore-dev"),
-			MinSeverity:   cmd.Float64("min-severity"),
-			MaxDepth:      cmd.Int("max-depth"),
-			UpgradeConfig: upgrade.NewConfigFromStrings(cmd.StringSlice("upgrade-config")),
-		},
+		MavenManagement:   cmd.Bool("maven-fix-management"),
+		IgnoreVulns:       cmd.StringSlice("ignore-vulns"),
+		ExplicitVulns:     cmd.StringSlice("vulns"),
+		DevDeps:           !cmd.Bool("ignore-dev"),
+		MinSeverity:       cmd.Float64("min-severity"),
+		MaxDepth:          cmd.Int("max-depth"),
+		UpgradeConfig:     upgrade.NewConfigFromStrings(cmd.StringSlice("upgrade-config")),
 		Manifest:          cmd.String("manifest"),
 		Lockfile:          cmd.String("lockfile"),
 		Strategy:          strategy.Strategy(cmd.String("strategy")),

cmd/osv-scanner/internal/helper/misc.go

@@ -49,8 +49,8 @@ func PrintResult(stdout, stderr io.Writer, outputPath, format string, diffVulns
 		}
 	} else { // Output might be a terminal
 		if stdoutAsFile, ok := stdout.(*os.File); ok {
-			termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd())) //nolint:gosec // Fd() is safe to convert to int
-			if err != nil {                                          // If output is not a terminal,
+			termWidth, _, err = term.GetSize(int(stdoutAsFile.Fd()))
+			if err != nil { // If output is not a terminal,
 				termWidth = 0
 			}
 		}

cmd/osv-scanner/internal/testcmd/vcr.go

@@ -53,7 +53,7 @@ func (wht withHeadersTripper) RoundTrip(request *http.Request) (*http.Response,
 		request.Header.Set(key, value)
 	}
 
-	return wht.wrapper.Do(request) //nolint:gosec // Safe in tests
+	return wht.wrapper.Do(request)
 }
 
 var _ http.RoundTripper = withHeadersTripper{}

cmd/osv-scanner/mcp/command.go

@@ -121,9 +121,7 @@ func handleScan(_ context.Context, _ *mcp.CallToolRequest, input *scanVulnerable
 	action := osvscanner.ScannerActions{
 		DirectoryPaths:      input.Paths,
 		ScanLicensesSummary: false,
-		ExperimentalScannerActions: osvscanner.ExperimentalScannerActions{
-			StatsCollector: &statsCollector,
-		},
+		StatsCollector:      &statsCollector,
 		CallAnalysisStates: map[string]bool{
 			"go": true,
 		},

go.mod

@@ -1,6 +1,6 @@
 module github.com/google/osv-scanner/v2
 
-go 1.26.5
+go 1.27.0
 
 require (
 	charm.land/glamour/v2 v2.0.1

goreleaser-action.dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 RUN apk --no-cache add \
   ca-certificates \
   git \

goreleaser.dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 RUN apk add --no-cache \
     ca-certificates \
     git

internal/output/output_result.go

@@ -568,7 +568,7 @@ func getVulnList(vulnMap map[string]VulnResult) []VulnResult {
 // getNextFixVersion finds the next fixed version for a given vulnerability.
 // returns a boolean value indicating whether a fixed version is available.
 func getNextFixVersion(allAffected []*osvschema.Affected, installedVersion string, installedPackage string, ecosystem string) (bool, string) {
-	ecosystemPrefix := strings.Split(ecosystem, ":")[0]
+	ecosystemPrefix, _, _ := strings.Cut(ecosystem, ":")
 	vp, err := semantic.Parse(installedVersion, ecosystemPrefix)
 	if err != nil {
 		return false, VersionUnsupported
@@ -603,7 +603,7 @@ func getNextFixVersion(allAffected []*osvschema.Affected, installedVersion strin
 
 // calculatePackageFixedVersion determines the highest version that resolves the most known vulnerabilities for a package.
 func calculatePackageFixedVersion(ecosystem string, allVulns []VulnResult) string {
-	ecosystemPrefix := strings.Split(ecosystem, ":")[0]
+	ecosystemPrefix, _, _ := strings.Cut(ecosystem, ":")
 	maxFixVersion := ""
 	var vp semantic.Version
 	for _, vuln := range allVulns {

scripts/run_lints.sh

@@ -2,5 +2,5 @@
 
 set -ex
 
-export GOTOOLCHAIN="${GOTOOLCHAIN:-go1.26.4}"
+export GOTOOLCHAIN="${GOTOOLCHAIN:-go1.27.0}"
 go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(cat .golangci-lint-version) run ./... "$@"

scripts/test_env.dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.6-alpine3.23@sha256:e57c41c1d5864341031181b0db34b9a537bb5773eb6428e4e5bdaea0f9135406
+FROM golang:1.27.0-alpine3.23@sha256:3747dcba41c8b0db3211fda4db61638b980e17ac5bb3c94460a975a9cfe19395
 
 RUN apk --no-cache add \
   npm \