v0.24.1 — the stdlib fixes a FIPS stamp was hiding

A Go binary carries the toolchain that built it, and vexscan reads that string
to decide which stdlib advisories still apply. For a toolchain built with a
GOEXPERIMENT there are two spellings. runtime/debug writes the experiment as
a separate field —

go1.24.0 X:boringcrypto

— which normalization already dropped. A toolchain that bakes the experiment
into its own tag writes it with a hyphen instead:

$ go version -m dbg
dbg: go1.26.9-X:boringcrypto

and that one survived. A : is not legal in a semver prerelease, so OSV could
not range-match the version, and answered with every advisory ever filed
against stdlib.

The report said as much rather than hiding it —

build info reports 1.26.9-X:boringcrypto for stdlib, which OSV cannot
range-match; it answered with every advisory ever filed against the module,
so whether this build is already past the fix is unknown

— but "here are 39 of them, undetermined" is not a useful thing to say about a
toolchain that contains every one of those fixes.

The upgrade target was wrong the same way and for the same reason. These
advisories are fixed on two branches at once and the record carried both:
"fixed_versions": ["1.26.9", "1.27.2"]. pickFix picks the lowest fix above
the installed version, but with a version it cannot order it falls back to the
highest — so a 1.26.9 toolchain was told to move to 1.27.2 for a fix it already
had.

The fix

Cut a hyphenated suffix as well as a space-separated one. Safe in the direction
that matters: upstream's own prereleases carry no separator (go1.26rc1), so a
hyphenated suffix is a vendor annotation, and a toolchain tagged 1.26.9 is built
from 1.26.9's source whatever the vendor appended to it.

Measured

registry.rancher.com/rancher/nginx-ingress-controller:v1.15.1-prime16, --all:

before   39 stdlib findings   (33 linked, 6 not_present)
after     0

Every finding on that image was stdlib — it has no readable OS package database
— so the report empties entirely. That is the answer api.osv.dev gives directly:
querying stdlib at 1.26.9 returns zero vulns.

Scope

This is one string, and it moves only images whose toolchain hyphenates its
experiment. Nothing changes for an image built with a stock toolchain, whose
go1.26.9 parsed correctly before and parses correctly now. The hyphenated
stamp is what the Rancher FIPS toolchain emits, so the correction should reach
those images generally — measured here on one of them.