Merge branch 'feature/go-1.27' of bajdev/posts into main

content/2026-10-24-vps-part-4-building-posts.md

@@ -18,7 +18,7 @@ MIT license.
 
 | Layer | Choice |
 |---|---|
-| Language | Go 1.25, standard library `net/http` and `html/template` |
+| Language | Go 1.27, standard library `net/http` and `html/template` |
 | Markdown | [goldmark](https://github.com/yuin/goldmark), the only dependency |
 | Storage | Markdown files on disk; no database |
 | Front end | Server-rendered HTML and one stylesheet; no JavaScript |

go.mod

@@ -1,5 +1,5 @@
 module git.monoaf.com/bajdev/posts
 
-go 1.25.13
+go 1.27.3
 
 require github.com/yuin/goldmark v1.8.6

pull-releases/006-go-1-27/README.md

@@ -0,0 +1,41 @@
+# Require Go 1.27.3
+
+Branch `feature/go-1.27` · version 0.4.1
+
+## What changed
+
+- **`go.mod`:** `go 1.25.13` → `go 1.27.3`. The build now refuses to run on an older Go toolchain, so a release can't be built with an unsupported Go by accident.
+- **Part 4 of the VPS series:** the stack table now says Go 1.27.
+- **Version:** 0.4.1.
+
+## Why
+
+Go supports only the two newest major releases, so with 1.27 out, Go 1.25 no longer gets security fixes. The admin installed Go 1.27.3 from the openSUSE repo, and govulncheck showed what the old builds were carrying:
+
+| Binary | Built with | govulncheck |
+|---|---|---|
+| `posts` (live, before) | go1.25.13 | 11 standard library vulnerabilities, e.g. `html/template` escaping (GO-2026-6599, GO-2026-6600), `Range` header parsing (GO-2026-6609), MIME header limits (GO-2026-6608) |
+| `posts` (live, after rebuild) | go1.27.3 | No vulnerabilities found |
+| source, this branch | go1.27.3 | No vulnerabilities found |
+
+## Notes
+
+- **The fixes are already live.** Both apps were rebuilt from `main` with Go 1.27.3 and redeployed before this PR, since that was the same code with a newer compiler. This PR makes the toolchain requirement permanent.
+- Several of the old findings (HTTP/2, TLS) were likely not reachable from outside, because nginx handles HTTPS and HTTP/2 and talks to the app over plain HTTP/1.1 on localhost. They're fixed regardless.
+- No code changes; the app behaves exactly as in 0.4.0.
+
+## Testing
+
+- All tests pass with the race detector (`go test -race ./...`) on Go 1.27.3.
+- `govulncheck ./...` (v1.9.0): no vulnerabilities found.
+- Built and ran locally; the home page is unchanged.
+
+## Screenshots
+
+From the branch's build running locally.
+
+| Desktop | Mobile |
+|---|---|
+| [![Desktop](desktop.png)](desktop.png) | [![Mobile](mobile.png)](mobile.png) |
+
+🤖 Generated with [Claude Code](https://claude.com/claude-code)

pull-releases/README.md

@@ -32,3 +32,4 @@ screenshot, or its `README.md` doesn't load.
 | [003](003-css-cache-busting/) | Content hash on the stylesheet URL; this folder |
 | [004](004-release-notes-page/) | Release notes pages on the site |
 | [005](005-post-author/) | Author in the post header |
+| [006](006-go-1-27/) | Require Go 1.27.3 (security fixes) |

version.go

@@ -4,7 +4,7 @@ import "runtime/debug"
 
 // version is the release number shown on the About page. Bump it in the PR
 // that makes a user-visible change.
-const version = "0.4.0"
+const version = "0.4.1"
 
 // buildCommit returns the short git revision that `go build` stamped into the
 // binary, with "-dirty" if the tree had uncommitted changes, or "" if the