v4.8.0 — Go 1.27.2, and a patch that outruns staticcheck

A security pin, and the rule it needed: Go 1.27.2 writes export data no staticcheck release reads yet.

The pin moves to Go 1.27.2. It shipped on 2026-10-08 with fifteen security fixes, thirteen in the standard library and two in the go command. Under 1.27.1, govulncheck in the reference reports twelve of them as called: both html/template escaper fixes through render, Range parsing through ServeContent and the static file server, and multipart header parsing through the upload handler. So the old pin fails that gate in every web application. Under 1.27.2 it reports none. VERSIONS.md, the pin line in stack/go.md, and both GOTOOLCHAIN commands in operations/ci.md moved together.

A Go patch can outrun staticcheck. The go.dev/issue/81188 fix, backported to 1.27.2, makes the compiler write export data V5. Staticcheck 2026.2.1, still the newest release, reads only V4, so it checks no package that imports the standard library (dominikh/go-tools#1832, open). operations/ci.md now rules the case: the staticcheck line comes out under a dated README waiver that names the upstream issue, the pin stays, and the plain line is tried again on every dependency update. It costs every project its staticcheck run until upstream ships, and nothing else.

How that rule got here. The first answer ran the line under GOTOOLCHAIN=go1.27.1, and seven review rounds took it apart. Under 1.27.1, a type that declares a generic method before a non-generic one brings the bug back, and staticcheck panics on it or misfiles its findings. And the prefixed line refuses any go.mod that names a later patch, which go get, go mod tidy and go mod init all write under the pin. Andy chose the dated waiver over iterating on the prefix or holding the tag.

stack/makefile.md rule 5 is now Adjustments. Besides the three layouts, it names what operations/ci.md lets a project's Makefile hold: the previous staticcheck version while a release of it breaks the gate, the line out under a dated waiver, and a go fix fixer switched off by name. That closes two v4.7.0 collisions, where ci.md told a project to do something rule 5's "exactly these" forbade. The three checklists' Makefile box reads "differing only as its rule 5 allows".

What the run found that is older than this release. The canonical fmt loop exited 0 when go fix did not converge, though its comment has said since v4.6.0 that it fails; it now fails after three passes. Four code blocks carried # comments, which macOS's interactive zsh hands to the command as words. And ci.md said the pin refuses any dependency that asks for a newer Go. It takes one that asks for its own patch and raises the go line, and ci.md now names the command that shows which module asked.

Not in this release. The child-process pattern, patterns/go-child-process.md: five rounds did not bring it to two clean passes, and the security pin did not wait on it. It is back on main in the commit after this tag, still owed a run, with round five's ten findings open. VERSIONS.md keeps its 2026-09-08 date: htmx 2.0.11 and modernc.org/sqlite v1.60.1 have shipped since, and 2.0.11 backports <hx-partial> from 4.0, which wants a ruling rather than a bump.

Budgets: every budgeted path got shorter. Change paths: cli-tool 5,332 → 5,311, library 4,351 → 4,340, web-application 7,985 → 7,963. Floors: cli-tool 11,597 → 11,575, library 12,504 → 12,494, web-application 21,363 → 21,342. Reach grew, mostly in operations/ci.md and stack/makefile.md.

This release does not meet the gate's first condition. Eight rounds of two adversarial passes each found defects, from 19 in the first to 11 in the eighth, and Andy stopped review there. Round eight's eleven fixes went through the reference but no review pass, and VERIFICATION.md keeps them owed to the next run. The ones worth remembering:

• The release block in operations/cli-release.md, pasted as written, tagged and pushed after a red make ci.
• The go list that shows which module asked for a newer Go needed -e to list anything in the very state it was offered for.
• Under 1.27.1, a dependency's type with its generic method declared first misfiled staticcheck's findings into the project importing it: a false warning on one method, a real one missed on another.

Reference: baseline-reference v4.8.0, pinning e7e378c: ./verify.sh exits 0 over 79 gates with staticcheck waived, and make ci is green. No staticcheck release runs under the pin, so this run's staticcheck findings came from v0.8.1 rebuilt against golang.org/x/tools v0.51.0, the one build that reads 1.27.2's export data.