Plugins with go 1.27.0 in go.mod fail the govulncheck source scan with
Error severity govulncheck-scan-failed, blocking validation:
This application uses version go 1.26 of the source-processing packages
but runs version go 1.27 of go list
/usr/local/go/src/math/rand/v2/rand.go:213:17: method must have no type parameters
Cause: the govulncheck binary is built in the golang:1.26-alpine builder
stage, while the Go toolchain used by go list at runtime is 1.27. Go 1.27
stdlib uses generic methods, which the 1.26 go/types packages cannot parse.
Same class of mismatch as #617.
Running govulncheck v1.7.0 built with Go 1.27 locally on the same module
reports "No vulnerabilities found".
Suggested fix: build govulncheck with the same Go version that runs at
runtime (or install it with GOTOOLCHAIN=auto at build time), and keep the
builder and runtime stages in sync.
Plugins with
go 1.27.0in go.mod fail the govulncheck source scan withError severity
govulncheck-scan-failed, blocking validation:This application uses version
go 1.26of the source-processing packagesbut runs version
go 1.27ofgo list/usr/local/go/src/math/rand/v2/rand.go:213:17: method must have no type parametersCause: the govulncheck binary is built in the
golang:1.26-alpinebuilderstage, while the Go toolchain used by
go listat runtime is 1.27. Go 1.27stdlib uses generic methods, which the 1.26 go/types packages cannot parse.
Same class of mismatch as #617.
Running govulncheck v1.7.0 built with Go 1.27 locally on the same module
reports "No vulnerabilities found".
Suggested fix: build govulncheck with the same Go version that runs at
runtime (or install it with GOTOOLCHAIN=auto at build time), and keep the
builder and runtime stages in sync.