Upgrade to Go 1.27.2

[tnsardesai]

Summary

Go 1.25 and older are out of support now that Go 1.27 has shipped. This moves the repo to the latest patch release, Go 1.27.2.

module	before	after
test/container-remediation/go.mod	go 1.24.0	go 1.27.2

Breaking changes and GODEBUG review

Raising the go line changes these defaults (none are overridden in this repo, via godebug blocks, //go:debug or GODEBUG env):

• Go 1.25: containermaxprocs=1 / updatemaxprocs=1 (GOMAXPROCS follows the cgroup CPU limit), decoratemappings=1, embedfollowsymlinks=0, tlssha1=0, x509sha256skid=1
• Go 1.26: urlstrictcolons=1 (url.Parse rejects extra colons in the host), cryptocustomrand=0 (crypto ignores caller-supplied rand readers), tlssecpmlkem=1 (SecP256r1MLKEM768/SecP384r1MLKEM1024 on by default)
• Go 1.27: tracebacklabels=1 (pprof goroutine labels are printed in tracebacks)

Removed outright in 1.27 (new behavior regardless of the go line): asynctimerchan, gotypesalias, tls10server, tlsrsakex, tls3des, tlsunsafeekm, x509keypairleaf. None are set here.

Toolchain changes that apply as soon as 1.27 builds the code: encoding/json runs on the v2 implementation (same behavior, different error text), HTTP/1 Response.Body.Close drains unread bodies, ServeMux trailing-slash redirects are 307 (1.26), Green Tea GC is on (1.26), go test runs the stdversion vet check, and gofmt alignment changed slightly.

Repo-specific findings:

• This module is the self-test fixture; container-remediation-self-test.yml passes it as go-version-file, so remediation self-tests now run on 1.27.2. Dependency versions are unchanged.

Verification

• security-workflows/test/container-remediation: go build ./... pass, go vet ./... pass, no test packages

---

Note

Low Risk
Single-module go line bump for a test fixture; no application logic or dependency version changes.

Overview
Bumps the test/container-remediation fixture module from Go 1.24.0 to Go 1.27.2 so container-remediation self-tests (via go-version-file in container-remediation-self-test.yml) build and run on a supported toolchain. Dependency versions in go.mod are unchanged; only the go directive moves forward, inheriting 1.25–1.27 runtime defaults and toolchain behavior described in the PR notes.

^{Reviewed by Cursor Bugbot for commit fdc57fb. Bugbot is set up for automated code reviews on this repo. Configure here.}