golang: replace 1.26 with 1.27

[GeorgeSapkin]

📦 Package Details

Maintainer: me

Description:

Replace Go 1.26 with 1.27.

Split into several commits so it can be backported to 25.12.

Remove redundant quotes in extra_provides.

Fix binary stripping when using previous version as a bootstrap.

Fixes: 5657eb0 ("golang: split src into separate packages")
Fixes: a6e9444 ("golang: fix missing dependency check")
Fixed: CVE-2026-33818
Fixed: CVE-2026-39821
Fixed: CVE-2026-46600
Fixed: CVE-2026-56853
Fixed: CVE-2026-56858
Fixed: CVE-2026-56859
Fixed: CVE-2026-56860
Fixed: CVE-2026-56862
Fixed: CVE-2026-56864
Fixed: CVE-2026-56865
Link: https://go.dev/doc/go1.27

---

🧪 Run Testing Details

• OpenWrt Version: SNAPSHOT, r35771-91a1245ad7
• OpenWrt Target/Subtarget: x86/64
• OpenWrt Device: QEMU

Tested building and running Syncthing.

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

[openwrt]

Formality Check: Failed

We checked this pull request against the contribution guidelines. Here is what needs your attention:

🛑 CRITICAL ERRORS

Commit bb85edd - golang: add 1.27.0:

• Makefile line '$(eval $(call BuildPackage,$(PKG_NAME)))' reuses PKG_NAME in a call, define, or eval. Use the literal package name instead.
• Makefile line '$(eval $(call BuildPackage,$(PKG_NAME)-doc))' reuses PKG_NAME in a call, define, or eval. Use the literal package name instead.
• Makefile line '$(eval $(call BuildPackage,$(PKG_NAME)-misc))' reuses PKG_NAME in a call, define, or eval. Use the literal package name instead.
• Makefile line '$(eval $(call BuildPackage,$(PKG_NAME)-src))' reuses PKG_NAME in a call, define, or eval. Use the literal package name instead.
• Makefile line '$(eval $(call BuildPackage,$(PKG_NAME)-tests))' reuses PKG_NAME in a call, define, or eval. Use the literal package name instead.

⚠️ STYLISTIC WARNINGS & SUGGESTIONS

Package Release Audit:

• ⚠️ Content changed in these packages, but without a PKG_RELEASE or version bump:

  • lang/golang

  Increment PKG_RELEASE by 1 (or bump PKG_VERSION/PKG_SOURCE_DATE and reset PKG_RELEASE to 1) so users receive the update.

Do not increment release for minor changes. Cosmetic edits (e.g., typos in comments, copyright updates, formatting/whitespace), changing the package maintainer (PKG_MAINTAINER), or updating source download info (PKG_SOURCE_URL / PKG_HASH) do not require incrementing PKG_RELEASE.

Tip

Do not close this pull request to make corrections. Instead, modify your existing commits (e.g. git commit --amend) and update the branch using git push --force-with-lease --force-if-includes. The checks will re-run automatically.

---

_{Something broken? Consider reporting an issue.
Running version 0e15d1c deployed on 2026-08-12 22:36:32 CEST}

[openwrt-ai]

Reviewed 5 commits. The only thing I'd call blocking is the release-candidate question in the inline comment on golang1.27/Makefile — the rest is small.

Commit checks

• e8593ee "golang: add 1.27.0" — the commit adds go1.27rc2 (GO_VERSION_RC:=2, GO_VERSION_PATCH empty, source go1.27rc2.src.tar.gz), not 1.27.0; upstream has no go1.27.0 tag yet. Subject, the Fixes: CVE-... lines and Link: https://go.dev/doc/go1.27 all read as if a final release. It also changes test.sh's heredoc quoting relative to the 1.26 copy it is derived from, which the message doesn't mention (see inline).
• 9211919 "golang: fix target binary stripping" — the body says "Fix stripping when using previous version as a bootstrap", but the diff changes go-strip-helper to ../go-strip-helper in RSTRIP, which affects every build: a bare go-strip-helper has no slash, so the shell resolves it through $PATH and never finds it, regardless of which bootstrap is used. The relative form matches the existing include ../golang-version.mk convention and looks right; only the explanation seems narrower than the fix.

The extra_provides cleanup in ee26052 is a genuine no-op in output ('libc.so.6' libstdc++.so.6' libtiff.so.6' already concatenates to the same three names) — the message describes it accurately.

PKG_NAME reuse in the BuildPackage calls and the PKG_RELEASE audit are already covered by the formality bot, so I won't repeat them.

---

Generated by Claude Code

[openwrt-ai]

This packages go1.27rc2, not a release. git ls-remote https://github.com/golang/go 'refs/tags/go1.27*' currently returns only go1.27rc1 and go1.27rc2, and go1.26.5 is still the newest 1.26 tag. Combined with f011294 (GO_DEFAULT_VERSION:=1.27) and 269df43 (drop 1.26), this makes an unreleased release candidate the default toolchain for every Go package in the feed and removes the last stable Go from the tree. Two concrete consequences:

1. The version check fails in CI on i386_pentium-mmx, x86_64, aarch64_generic, arm_cortex-a15_neon-vfpv4 and mips_24kc:

golang1.27: [pass] All linked libraries for /usr/lib/go-1.27/pkg/tool/linux_386/vet are present
golang1.27: [fail] Version check override
golang1.27: Generic tests failed

With GO_VERSION_RC set and GO_VERSION_PATCH empty, PKG_VERSION evaluates to 1.27.0 via the $(if $(GO_VERSION_RC),.0) branch, so test-version.sh:16 greps for " go1.27.0 " while the installed toolchain reports go1.27rc2. Every previous release in this tree set GO_VERSION_PATCH with an empty GO_VERSION_RC, so this path has not been exercised before.

2. The same mismatch is visible to users — the packages install as 1.27.0-r1 (Purging golang1.27 (1.27.0-r1) in the same log) while the toolchain is rc2.

The PR body also lists two advisories under Fixes:; an RC is an odd vehicle for a security fix, and 1.26.5 (the version being dropped) is upstream's current stable. Is the intent to hold this until go1.27.0 is tagged, or is shipping rc2 as the feed default deliberate? If the latter, please say so in the commit message — and either the PKG_VERSION scheme or test-version.sh needs to agree on how RC builds are named.

---

Generated by Claude Code

[egc112]

Thanks for your ongoing support and many contributions.
Just a question is this new golang version compatible with the current used netbird version (0.73.2)?

[GeorgeSapkin]

is this new golang version compatible with the current used netbird version (0.73.2)?

I don't use netbird. Also, this is a draft. 1.27 has not been released yet. 25.12 will have both 1.26 and 1.27 available, only snapshot will switch to 1.27.

[openwrt-ai]

Reviewed 3 new commits (branch was rebased; ee26052 and 9211919 are unchanged).

The whole content delta since 269df43 is one line — cat <<EOF → cat <<'EOF' in golang1.27/test.sh. That resolves the nit from the last round: the file is now byte-identical to golang1.26/test.sh, and GitHub shows it as a pure rename again. 673ef2f and c7f3e15 both do exactly what their subjects say (GO_DEFAULT_VERSION:=1.27, and deleting the three golang1.26/ files).

Commit checks

• a3d63c6 "golang: add 1.27.0" — rebase of e8593ee, message unchanged, so the subject/content mismatch carries over: the Makefile adds go1.27rc2 (GO_VERSION_RC:=2, empty GO_VERSION_PATCH, PKG_SOURCE:=go1.27rc2.src.tar.gz), not 1.27.0. Re-checked at review time — git ls-remote https://github.com/golang/go 'refs/tags/go1.27*' still returns only go1.27rc1 and go1.27rc2, and go1.26.5 is still the newest 1.26 tag. The open thread on golang1.27/Makefile covers the consequences (the PKG_VERSION → test-version.sh mismatch, and the same five targets are still red); nothing there has changed, so I won't repeat it inline. Understood from your reply on the netbird question that this is deliberately a draft until 1.27 is tagged.

Nothing else new. The remaining CI failures and the PKG_NAME-reuse errors are the same ones already reported by the formality bot.

---

Generated by Claude Code

[vortexilation]

@GeorgeSapkin

Thanks for the update, currently there is compilation error for sing-box :

/home/nameless/works/openwrt/staging_dir/toolchain-x86_64_gcc-16.1.1_glibc/x86_64-openwrt-linux-gnu/bin/ld.bfd: /home/nameless/works/openwrt/tmp/go-link-2382788295/go.o: in function `github.com/sagernet/sing-box/transport/v2rayhttp.ResetTransport':
go.go:(.text+0xd4fc81): undefined reference to `golang.org/x/net/http2.(*Transport).connPool'
collect2: error: ld returned 1 exit status

[openwrt-ai]

Reviewed 3 new commits (branch was rebased; ee26052 and 9211919 are unchanged).

The entire content delta since c7f3e15 is the release-candidate bump in golang1.27/Makefile — GO_VERSION_RC:=2 → 3 plus the matching PKG_HASH. Re-verified upstream at review time: git ls-remote https://github.com/golang/go 'refs/tags/go1.27*' returns go1.27rc1, go1.27rc2 and go1.27rc3, so rc3 is the newest 1.27 tag and go1.27.0 is still untagged. The open thread on golang1.27/Makefile therefore still applies as written (PKG_VERSION resolves to 1.27.0 while the toolchain reports go1.27rc3, and test-version.sh:16 greps for " go1.27.0 "). You have already said this stays a draft until 1.27 ships, so I won't re-litigate it — it resolves itself the moment GO_VERSION_RC is cleared and GO_VERSION_PATCH:=0, at which point both PKG_VERSION and PKG_FILE_VERSION evaluate to 1.27.0.

I could not verify the new PKG_HASH: go.dev is not reachable from this environment.

62b4b8b and 1f5765c do exactly what their subjects say (GO_DEFAULT_VERSION:=1.27, and deleting the three golang1.26/ files). git grep golang1.26 at head comes back empty, so nothing in the feed is left pointing at the dropped package.

Commit checks

• 88b866b "golang: add 1.27.0" — the CVE trailers are no longer consistent. Ten lines use Fixed: CVE-..., but the two entries added this round use Fixes: CVE-2026-39822 and Fixes: CVE-2026-42505. Everywhere else in this series Fixes: introduces a commit SHA (Fixes: 5657eb0e2 ("golang: split src into separate packages") in 9211919, Fixes: a6e94447f ("golang: fix missing dependency check") in ee26052), and the PR body follows the same split, so the two odd lines read as commit references rather than advisories. Worth settling on Fixed: for all twelve. Those same two CVEs are also missing from the PR body, which still lists only the original ten.
• The subject still names 1.27.0 while the Makefile packages go1.27rc3 — noted for completeness only, since it goes away with the RC.

---

Generated by Claude Code