[jinxiao]

Issue

Refs #255

Summary

Require Go 1.27.3 across the independent modules and update vulnerable dependency selections: x/net to v0.61.0 (which selects x/crypto v0.58.0), x/text to v0.43.0, x/sys to v0.49.0, and gRPC to v1.83.2. Go 1.27.3 includes the latest crypto/x509 correction; the prior 1.27.2 fixes cover the October TLS/HTTP/template advisories.

Use pinned govulncheck v1.9.0 against each extracted module archive on Linux amd64 and arm64 with GOWORK=off. Reachable findings fail existing module acceptance; verbose evidence accompanies the report. Migrate the private Avro codec from archived Hamba v2.31.0 to the maintained iskorotkov v2.34.0 with explicit byte/array/map limits, retaining the existing first-party cumulative item budget. GO-2026-5046/5047/5048 blocked the first full CI run; no advisory is suppressed. Failed scanner output is saved before propagating its error. Keep root Commons dependency-free, JSON v2, CGO disabled, and the frozen X-Ray adapter without new features.

Testing

• Passed: full 31-module metadata tidy, actionlint, 28 contribution-policy tests, 24 CI selection/gate/evidence tests, and all 31 module license/notice checks.

• Before-upgrade isolated Linux source scans: Tracer reports 10 reachable standard-library advisories plus 5 imported-package findings; KMS reports 9 reachable standard-library advisories plus 3 package and 2 module findings.

• Local Docker engine is stopped. Full packaged tests, vulnerability scans, dual-architecture Lambda builds, DynamoDB Local, runtime simulation, docs and release tooling must pass in hosted CI before merge.

• Two additional baseline scans were interrupted by local disk exhaustion; they are not clean results. Only reproducible compilation/module caches were removed to restore capacity.

• Avro targeted acceptance: tests, vet, tidy and Linux amd64/arm64 symbol scans passed. Resume only consumer/isolation checks after the full graph exposed upstream lint-tool Protobuf dependencies; compiled Lambda imports must remain Protobuf-free.

• Update frozen X-Ray source dependencies to fasthttp v1.70.0 and compress v1.18.7; the adapter remains deprecated and excluded from new publication. Retain all upstream tool dependencies in inventory while checking Avro runtime isolation on both Lambda architectures.

• Final hosted CI 39878398716 passed on e91d101: all 31 packaged modules, 28 standalone consumers, all 62 Linux amd64/arm64 symbol scans with no reported findings, both static Lambda artifacts, Runtime simulation, DynamoDB Local, docs and release tooling. Full regression and contribution policy passed. Raw scan evidence is retained in the CI artifacts.

Risks and compatibility

The minimum Go patch increases to 1.27.3. Existing Lambda binaries need rebuilding; updating source dependencies does not patch deployed artifacts. x/text updates Unicode tables, covered by Validation regression tests. Vulnerability results reflect the current public Go database and symbol reachability rather than proof of exploitability or freedom from future advisories. The next unified cohort also includes the existing Logger stacks Preview; its Preview status is retained, and availability comments no longer falsely restrict tagged code to main. This PR does not publish versions; reviewed unified release preparation follows its merge.

Release notes

• . | maintenance | Require Go 1.27.3 or newer to include current standard-library security fixes.
• tracer | fix | Update HTTP/2 and gRPC dependencies to patched versions and select x/crypto v0.58.0 in the dependency graph.
• eventhandler/http/tracer | fix | Align tracing middleware with patched HTTP/2 and gRPC dependencies.
• validation | maintenance | Update Unicode text processing to golang.org/x/text v0.43.0.
• kafka/avro | fix | Use the maintained Avro codec with integer-boundary fixes and explicit allocation caps for untrusted data.
• logger | documentation | Retain stacks Preview status while clarifying availability beyond v1.2.0.
• repository | maintenance | Scan isolated packaged modules for reachable Linux amd64 and arm64 vulnerabilities during CI.

Checklist

• The issue records the scope and acceptance criteria
• Tests and documentation match the change, or I explained why they are not applicable
• I kept CGO disabled and did not run cloud AWS tests without authorization
• I excluded credentials, personal configuration, and generated build artifacts

[jinxiao]

Review of e91d101:

1. Resolved: upgrading Go/net alone left archived Hamba Avro affected by GO-2026-5046/5047/5048. The private codec now uses iskorotkov v2.34.0, with explicit byte/slice/map limits and the existing cumulative collection cap. Malformed count/size regression tests, the pinned TypeScript corpus, tests/vet/tidy and both architecture symbol scans passed locally.
2. Resolved: a failed scanner previously threw before its artifact was written. The shared command runner now persists stdout/stderr before propagating failure; a real exit-3 subprocess regression confirms failure blocks acceptance and preserves evidence.
3. Resolved: the maintained fork declares upstream lint tools with Protobuf dependencies. The full graph remains in the inventory; separate real Linux amd64/arm64 package closures and consumer builds prove Protobuf is absent from Avro runtime code. The core remains subject to the stricter full-graph dependency ban, with a regression preventing bypass.
4. Updated the frozen adapter source dependencies for its remaining fasthttp/compress advisories; it stays deprecated and excluded from new publication. Existing Preview comments now accurately permit the next tagged cohort without claiming v1.2.0 has the APIs.

No remaining code-level blocker identified in the reviewed diff. Merge remains conditional on the exact final head passing all hosted checks, including all 31 packaged modules, 62 Linux symbol scans, dual-architecture artifacts and runtime/service suites. This is an author/maintainer review under the documented single-maintainer policy, not an independent approval. No AWS test or release has been performed yet.

[jinxiao]

Final acceptance: CI run 39878398716 completed successfully for exact reviewed head e91d101, including Full regression and runtime acceptance. All 31 module reports and all 62 scanner logs were inspected; no vulnerability findings remain in the scanned package closures. No remaining review blocker. Proceeding with the user-authorized squash merge and separate unified release preparation; issue #255 remains open until publication and acceptance are complete.