chore/deps: update Go to 1.27.3 and all dependencies to latest

.github/workflows/docker.yml

@@ -16,16 +16,16 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       # We need buildx to be able to build a multi-architecture image.
       - name: Set up Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # We also need QEMU, since this is running on an AMD64 host and we want to
       # build ARM64 images.
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
 

.github/workflows/go-ci.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Get Go version from mise
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT

.github/workflows/go-lint.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Get Go version from mise
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT

.github/workflows/goreleaser-check.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Get Go version from mise

.github/workflows/goreleaser.yml

@@ -47,7 +47,7 @@ jobs:
       second_latest_tag: ${{ env.second_latest_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Set current tag, latest (highest version) tag, and second latest tag
@@ -103,7 +103,7 @@ jobs:
           echo "latest_tag=${{ needs.release_type.outputs.latest_tag }}" >> $GITHUB_ENV
           echo "second_latest_tag=${{ needs.release_type.outputs.second_latest_tag }}" >> $GITHUB_ENV
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Set versioning variables
@@ -116,7 +116,7 @@ jobs:
           echo "Versioned formula file: ${{ env.versioned_formula_file }}"
           echo "Versioned classname: ${{ env.versioned_classname }}"
       - name: Checkout Homebrew tap
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: sourcegraph/homebrew-src-cli
           fetch-depth: 0
@@ -171,7 +171,7 @@ jobs:
         run: |
           echo "Goreleaser config file: ${{ env.config_file }}"
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Get Go version from mise
@@ -223,7 +223,7 @@ jobs:
           echo "Old symlink: ${{ env.old_symlink_name }}"
           echo "New symlink: ${{ env.new_symlink_name }}"
       - name: Checkout Homebrew tap
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: sourcegraph/homebrew-src-cli
           fetch-depth: 0
@@ -244,12 +244,12 @@ jobs:
     needs: goreleaser
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
-          node-version: 24.16.0
+          node-version: 26.13.0
           registry-url: 'https://registry.npmjs.org'
       - run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
       - run: echo "Releasing version ${{ env.version }}"

.github/workflows/scip.yml

@@ -5,9 +5,8 @@ on:
 jobs:
   scip-go:
     runs-on: ubuntu-latest
-    container: sourcegraph/scip-go
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Get Go version from mise
         id: mise
         run: echo "go-version=$(grep 'golang' mise.toml | cut -d'"' -f2)" >> $GITHUB_OUTPUT
@@ -16,8 +15,11 @@ jobs:
         with:
           go-version: ${{ steps.mise.outputs.go-version }}
 
-      - name: Set directory to safe for git
-        run: git config --global --add safe.directory $GITHUB_WORKSPACE
+      # Built with the same Go toolchain as src-cli, so scip-go recognizes
+      # every stdlib package of that Go version. The sourcegraph/scip-go
+      # Docker image stopped at v0.1.26 (Go 1.26) and fails on Go 1.27.
+      - name: Install scip-go
+        run: go install github.com/scip-code/scip-go/cmd/[email protected]
 
       - name: Build src-cli
         run: go build -o ./src-cli ./cmd/src

CHANGELOG.md

@@ -15,8 +15,19 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Changed
 
+### Fixed
+
+### Removed
+
+## 8.1.2687
+
+### Added
+
+### Changed
+
 - Updated Go to 1.26.10 and the Alpine `ca-certificates-bundle` in Docker images to 20261020-r0 to stop trusting the compromised eMudhra CAs ([CVE-2026-111943](https://emudhra.we-have-a-problem.com/)).
 - Updated Go dependencies to patch all open Trivy and Dependabot findings: `golang.org/x/crypto`, `golang.org/x/net`, `golang.org/x/text`, `golang.org/x/mod`, `github.com/klauspost/compress`, `github.com/go-jose/go-jose/v4`, `google.golang.org/grpc`, and `go.opentelemetry.io/otel/sdk`.
+- Updated Go to 1.27.3, Alpine base images to 3.24, GitHub Actions to current major versions, and all Go dependencies to their latest versions. `src snapshot upload` now loads the `-credentials-file` strictly as a service account key.
 - HTTP requests now fail instead of hanging forever if the server does not start responding within 1 minute. Set the `SRC_RESPONSE_HEADER_TIMEOUT` environment variable to change this timeout, or to `0` to disable it. Responses that stream data for a long time (for example, large search job results) are not affected.
 - `src search-jobs logs` and `src search-jobs results` now use the standard API client, gaining proxy support, `-insecure-skip-verify`, and cross-host redirect protection, and now report an error on non-200 responses instead of writing the error page into the output.
 - The command list in `src help` is now generated from the registered commands instead of being maintained by hand. `src debug`, `src snapshot`, and `src lsp` now appear in it; aliases are shown after each description.

DEVELOPMENT.md

@@ -102,6 +102,8 @@ If a backwards-compatible change, such as a bug fix, is made _after_ a backwards
 
 A Sourcegraph instance returns the highest patch version with the same major and minor version as `MinimumVersion` as defined in the instance. Patch versions are reserved solely for non-breaking changes and minor bug fixes. This allows us to dynamically release fixes for older versions of `src-cli` without having to update the instance.
 
+Patch numbers must only increase within a minor line. Since 8.1.2687, releases carry the Sourcegraph build number as the patch component, so a later 8.1.x must use a number above 2687 (for example the current Sourcegraph 8.1 build number). A lower number such as 8.1.1 would be treated as a patch of an older version by the Build and Release action (no `latest` tag or main Homebrew formula) while sourcegraph.com would still recommend it as the newest 8.1 release.
+
 To release a bug fix or a new feature that is backwards compatible with one of the previous two minor version of Sourcegraph, cherry-pick the changes into a patch branch, then follow the steps above to release the patch, specifying the appropriate patch `VERSION`. The Build and Release action will automatically create the appropriate versioned release, without overwriting the latest one.
 
 ## Docker

Dockerfile

@@ -4,14 +4,14 @@
 #
 # Nothing fancy here: we copy in the source code and build on the Alpine Go
 # image. Refer to .dockerignore to get a sense of what we're not going to copy.
-FROM golang:1.26.10-alpine3.23@sha256:a07f231c19b03e6106cf442f02a5bcf262147e744d15b7b5e4b6d81d420c70a0 AS builder
+FROM golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb AS builder
 
 COPY . /src
 WORKDIR /src
 RUN go build ./cmd/src
 
 # This stage should be kept in sync with Dockerfile.release.
-FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
+FROM alpine:3.24@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
 
 # needed for `src code-intel upload` and `src actions exec`
 # ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).

Dockerfile.release

@@ -2,7 +2,7 @@
 # suitable for testing, since it depends on a src binary being at the project
 # root _and_ that src binary being runnable on Alpine. To test this, refer to
 # the main Dockerfile, which should have an identical second stage.
-FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
+FROM alpine:3.24@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
 
 # needed for `src code-intel upload` and `src actions exec`
 # ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).

cmd/src/code_intel_upload.go

@@ -140,30 +140,24 @@ func codeintelUploadOptions(out *output.Output) upload.UploadOptions {
 	)
 
 	return upload.UploadOptions{
-		UploadRecordOptions: upload.UploadRecordOptions{
-			Repo:              codeintelUploadFlags.repo,
-			Commit:            codeintelUploadFlags.commit,
-			Root:              codeintelUploadFlags.root,
-			Indexer:           codeintelUploadFlags.indexer,
-			IndexerVersion:    codeintelUploadFlags.indexerVersion,
-			AssociatedIndexID: associatedIndexID,
-		},
-		SourcegraphInstanceOptions: upload.SourcegraphInstanceOptions{
-			SourcegraphURL:      cfg.endpointURL.String(),
-			AccessToken:         cfg.accessToken,
-			AdditionalHeaders:   cfg.additionalHeaders,
-			MaxRetries:          5,
-			RetryInterval:       time.Second,
-			Path:                codeintelUploadFlags.uploadRoute,
-			MaxPayloadSizeBytes: codeintelUploadFlags.maxPayloadSizeMb * 1000 * 1000,
-			MaxConcurrency:      codeintelUploadFlags.maxConcurrency,
-			GitHubToken:         codeintelUploadFlags.gitHubToken,
-			GitLabToken:         codeintelUploadFlags.gitLabToken,
-		},
-		OutputOptions: upload.OutputOptions{
-			Output: out,
-			Logger: logger,
-		},
+		Repo:                codeintelUploadFlags.repo,
+		Commit:              codeintelUploadFlags.commit,
+		Root:                codeintelUploadFlags.root,
+		Indexer:             codeintelUploadFlags.indexer,
+		IndexerVersion:      codeintelUploadFlags.indexerVersion,
+		AssociatedIndexID:   associatedIndexID,
+		SourcegraphURL:      cfg.endpointURL.String(),
+		AccessToken:         cfg.accessToken,
+		AdditionalHeaders:   cfg.additionalHeaders,
+		MaxRetries:          5,
+		RetryInterval:       time.Second,
+		Path:                codeintelUploadFlags.uploadRoute,
+		MaxPayloadSizeBytes: codeintelUploadFlags.maxPayloadSizeMb * 1000 * 1000,
+		MaxConcurrency:      codeintelUploadFlags.maxConcurrency,
+		GitHubToken:         codeintelUploadFlags.gitHubToken,
+		GitLabToken:         codeintelUploadFlags.gitLabToken,
+		Output:              out,
+		Logger:              logger,
 	}
 }
 

cmd/src/code_intel_upload_vendored.go

@@ -176,7 +176,6 @@ func uploadMultipartIndexParts(ctx context.Context, httpClient upload.Client, op
 	}
 
 	for i, reader := range readers {
-		i, reader := i, reader
 
 		pool.Go(func(ctx context.Context) error {
 			// Determine size of this reader. If we're not the last reader in the slice,

cmd/src/doc_test.go

@@ -198,7 +198,7 @@ func TestDocRootIndexMatchesHelp(t *testing.T) {
 	}
 
 	var indexed []string
-	for _, line := range strings.Split(string(index), "\n") {
+	for line := range strings.SplitSeq(string(index), "\n") {
 		// Lines look like: * [`name`](name.md) or * [`name`](name/index.md)
 		rest, ok := strings.CutPrefix(strings.TrimSpace(line), "* [`")
 		if !ok {

cmd/src/help_test.go

@@ -44,7 +44,7 @@ func helpCommandNames(t *testing.T, help string) []string {
 	block, _, _ = strings.Cut(block, "\nUse \"src [command] -h\"")
 
 	var names []string
-	for _, line := range strings.Split(block, "\n") {
+	for line := range strings.SplitSeq(block, "\n") {
 		line = strings.TrimSpace(line)
 		if line == "" {
 			continue

cmd/src/snapshot_upload.go

@@ -295,8 +295,6 @@ func uploadFilesToBucket(client *gcsClient, args *uploadArgs, openedFiles []uplo
 	// Upload each file in parallel
 	for fileIndex, openedFile := range openedFiles {
 
-		openedFile := openedFile
-
 		uploadPool.Go(func(ctx context.Context) error {
 			progressFn := func(bytesWritten int64) { progress.SetValue(fileIndex, float64(bytesWritten)) }
 

dev/golangci-lint.sh

@@ -6,7 +6,7 @@ pushd "$(dirname "${BASH_SOURCE[0]}")/.." >/dev/null
 
 mkdir -p dev/.bin
 
-version="2.10.1"
+version="2.15.0"
 suffix="${version}-$(go env GOOS)-$(go env GOARCH)"
 target="$PWD/dev/.bin/golangci-lint-${suffix}"
 url="https://github.com/golangci/golangci-lint/releases/download/v${version}/golangci-lint-${suffix}.tar.gz"

dev/vendor-lib.sh

@@ -136,7 +136,7 @@ echo "Creating go.mod file..."
 cat > "$DEST_LIB/go.mod" <<EOF
 module github.com/sourcegraph/sourcegraph/lib
 
-go 1.26.10
+go 1.27.3
 EOF
 
 # Create README.md

docker/batch-change-volume-workspace/Dockerfile

@@ -2,7 +2,7 @@
 # image that we use to run curl, git, and unzip against a Docker volume when
 # using the volume workspace.
 
-FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
+FROM alpine:3.24@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
 
 # ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
 RUN apk add --update git unzip && apk upgrade --no-cache ca-certificates-bundle