chore: refresh Go dependencies and fix CI - #355

Description

Raise the go.mod language/minimum toolchain version from Go 1.24.1 to 1.26.0 and refresh selected direct/transitive dependencies and checksums. CI and release builds use Go 1.27.3, configured by the merged prerequisite PR #354.

Update the lint job to set up that Go toolchain and run golangci-lint v2.15.0 through the v9 action. Fix lint findings with behavior-preserving cleanup: explicitly discard previously ignored errors, simplify redundant expressions/selectors, and remove an unreachable nil-cache check. Preserve existing signing, output flushing, close-error, and environment-default behavior.

Keep containerd on the 1.x line, updating v1.7.27 to v1.7.36. Retain stereoscope v0.1.2, runc v1.1.10, and the original runc library-based rootless jail configuration.

Keep the isolated flaky-test fix: use io.Discard in command flag tests instead of wrapping file descriptor 0 in os.File, whose finalizers can close stdin or a reused descriptor during workspace discovery.

Validation

Using Go 1.27.3:

CGO_ENABLED=0 go build -o /tmp/leeway .
go test ./... -skip '^TestSignCache_DryRunMode$'
golangci-lint run --timeout 5m
go mod tidy

The static build, local test suite above, and module tidy passed; golangci-lint v2.15.0 reports zero issues. TestSignCache_DryRunMode was skipped locally because Yarn was unavailable. GitHub CI passed the full suite, including that test.

Grype findings (November 5, 2026)

On November 5, scanned the retained dependency set in the source tree and a static binary with Grype v0.121.1 and that day's vulnerability database:

grype dir:. --fail-on critical
grype /tmp/leeway --fail-on critical

Both raw scans reported two critical matches against containerd v1.7.36 and exited with status 2. No ignores, suppressions, or VEX filters were applied.

The scanner records conflict with the affected-version ranges published by containerd:

• GO-2026-5064 / CVE-2026-53492 / GHSA-33vj-92qq-66hc
• GO-2026-5338 / CVE-2026-50195 / GHSA-cvxm-645q-p574

Both upstream advisories identify github.com/containerd/containerd/v2 as the affected Go package and list only >=2.1.0,<2.1.9, >=2.2.0,<2.2.5, and >=2.3.0,<2.3.2 as affected. Containerd v1.7.36 is outside those published ranges.

The corresponding Go record for GO-2026-5064 and Go record for GO-2026-5338 were marked UNREVIEWED at the time of the scan and additionally marked all versions of the containerd v1 module as affected. Based on the upstream advisories, the two v1.7.36 matches appear to be false positives in those Go records. Lower-severity findings also remain.

CI results

All GitHub Actions checks passed on 91b8e9edf376d251699ff0f128532ce00ce0d103:

• Unit tests workflow: module tidiness, lint, full unit suite, race tests, and coverage processing passed.
• Integration workflow: integration and determinism checks passed.

Relates to

• Leeway #354: Go 1.27.3 refresh, merged prerequisite.
• gitpod-next #32238: CI build tools.