build(deps): bump Go to 1.27.0 (toolchain go1.27.3), update deps, and add govulncheck action

.github/workflows/go_test.yml

@@ -6,7 +6,7 @@ jobs:
   test:
     strategy:
       matrix:
-        go-version: [1.26.x, 1.27.x]
+        go-version: [1.27.x]
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/golangci-lint.yml

@@ -23,5 +23,5 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.13.2
+          version: v2.15.0
           args: --timeout=8m

.github/workflows/govulncheck.yml

@@ -0,0 +1,25 @@
+name: govulncheck
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck_job:
+    runs-on: ubuntu-latest
+    name: Run govulncheck
+    steps:
+      - id: govulncheck
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
+        with:
+          go-version-file: go.mod
+          # Required to override the default 'stable' version and use go-version-file
+          go-version-input: ''
+          go-package: ./...

go.mod

@@ -1,10 +1,12 @@
 module github.com/transparency-dev/incubator
 
-go 1.26.0
+go 1.27.0
+
+toolchain go1.27.3
 
 require (
-	filippo.io/sunlight v0.9.0
-	filippo.io/torchwood v0.9.1-0.20260708154658-e0a6396dd50c
+	filippo.io/sunlight v0.10.2
+	filippo.io/torchwood v0.10.1-0.20261024135344-1c05157b1fd2
 	github.com/cockroachdb/pebble v1.1.5
 	github.com/go-git/go-git/v5 v5.19.3
 	github.com/google/go-cmp v0.7.0
@@ -19,7 +21,7 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.47.0
 	golang.org/x/crypto v0.58.0
 	golang.org/x/mod v0.42.0
-	golang.org/x/net v0.60.0
+	golang.org/x/net v0.62.0
 	golang.org/x/sync v0.24.0
 	k8s.io/klog/v2 v2.140.0
 )

go.sum

@@ -4,8 +4,12 @@ filippo.io/mldsa v0.0.0-20260711112038-ff3f469cee29 h1:11cJmDX5FvZu/znhVjfwxs9jZ
 filippo.io/mldsa v0.0.0-20260711112038-ff3f469cee29/go.mod h1:32qQ5yj3R24Eu03iWFWchdC3OB653wPvoepWejkefbY=
 filippo.io/sunlight v0.9.0 h1:YQnOlIjRuTsXzsXJdm+MMivu6OndV94iq/sMDASOn4k=
 filippo.io/sunlight v0.9.0/go.mod h1:o/a7PJt6Bw0bYhWnZDC8hHAUEQShVxUgsvltrHF/KoQ=
+filippo.io/sunlight v0.10.2 h1:XKjgEIlDMRxMIDpEAvH7cSHx/PCPMO5IJUgcIb3bo/A=
+filippo.io/sunlight v0.10.2/go.mod h1:jMYE8Fh4L94M9vkiX4N9Q3h5WLZMjKCxSCHq8gajzeM=
 filippo.io/torchwood v0.9.1-0.20260708154658-e0a6396dd50c h1:t259W9JzlCso86LB0V92ZmRJluFg1wEsiH4OonKAB5U=
 filippo.io/torchwood v0.9.1-0.20260708154658-e0a6396dd50c/go.mod h1:kKEN0olmFcNGfsPWT3M46wig9CUz7/vHIAENPh9pLXc=
+filippo.io/torchwood v0.10.1-0.20261024135344-1c05157b1fd2 h1:jvnFpZovtSQykQNSPLtlEmP5SClXCWn+1zCHU8jz6cY=
+filippo.io/torchwood v0.10.1-0.20261024135344-1c05157b1fd2/go.mod h1:hZt8lhTBBCK77TmuK+q0D7mNcnt2ovQkJs+zdonDRog=
 github.com/DataDog/zstd v1.4.5 h1:EndNeuB0l9syBZhut0wns3gV1hL8zX8LIu6ZiVHWLIQ=
 github.com/DataDog/zstd v1.4.5/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -190,6 +194,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
 golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=