go.mod

Rama main · réplica de lectura del repositorio original.

module github.com/quilzo/quilzo

go 1.27

// The toolchain is the entire supply chain here.
//
// go.mod has no require block, so the standard library is the only
// dependency this program has — which makes the Go release it is built
// with the whole of what a vulnerability scanner has to look at. Pinned to
// a floor rather than left to whatever is installed: govulncheck found
// eight reachable standard-library vulnerabilities on 1.26.4, all fixed in
// 1.26.6, and a bare "go 1.27" reads as 1.27.0 to a scanner.
//
// This project was pinned to 1.24 until August 2026. Go 1.24 reached end
// of life on 10 February 2026 and receives no security patches at all, so
// every released binary carried 29 known standard-library CVEs with no
// path to a fix. That is the cost of the zero-dependency argument being
// true: there is one dependency, and it has to be current.
//
// 1.27.3 because govulncheck found GO-2026-6809 on 21 October 2026:
// crypto/x509 still trusted intermediate certificates known to be
// compromised, reachable through every outbound TLS connection this program
// makes (model calls, single sign-on, webhooks, federation), fixed in
// 1.27.3. 1.27.2 had fixed twelve found in 1.27.0, among them two in
// html/template, which renders every admin screen.
toolchain go1.27.3