fix(deps): move golang.org/x/net to v0.60.0 and Go to 1.27.2 for GO-2026-6617 and the stdlib advisories

[lusoris]

Summary

golang.org/x/net moves from v0.59.0 to v0.60.0 and the Go toolchain from 1.27.1 to 1.27.2. GO-2026-6617 (an HTTP/2 server crash from an HPACK encoder race) was published on 2026-10-09. govulncheck ./... found it reachable from cmd/vmafx-controller, pkg/tune/executor, pkg/libvmaf and tools/obssmoke, so the pre-push security hook refused every push of the tree.

The same database release published twelve standard-library advisories (GO-2026-6599, 6600, 6603, 6604, 6605, 6607, 6608, 6609, 6610, 6611, 6612 and 6613) in html/template, net/http and its bundled HTTP/2, crypto/tls, os and mime/multipart. The standard library also carries GO-2026-6617 in its own HTTP/2 copy. With x/net alone, the CI go vet + go test job still failed at the govulncheck gate on Go 1.27.1 (run 37857903681). Go 1.27.2 fixes all thirteen.

go.mod declares go 1.27.2. RELEASE_GO_BASE and DEV_GO_BASE in build-config.env move to the golang:1.27-trixie digest that carries Go 1.27.2 (sha256:2f84bc93…); scripts/ci/check-base-image-single-source.sh --write rewrote the Dockerfile copies, and the observability compose file carries the same digest. Two docs pages that named Go 1.27.1 now name 1.27.2.

Type

• feat — new feature
• fix — bug fix
• perf — performance improvement
• refactor — no behavior change
• docs — documentation only
• test — test-only
• build / ci — tooling / infra
• port — cherry-pick from upstream Netflix/vmaf
• sycl / cuda / simd — backend-specific

Checklist

• Commits follow Conventional Commits (the commit-msg hook enforces this).
• Every commit is signed off (git commit -s; fix a branch with git rebase --signoff origin/master). See DCO sign-off.
• make format && make lint is green locally. Not run in full: go vet ./..., python3 scripts/ci/govulncheck-gate.py, scripts/ci/check-base-image-single-source.sh and the commit and push hooks ran on the changed files.
• Unit tests pass: python3 scripts/ci/run_meson_test.py -- -C build. Not applicable: no C change.
• If I touched any SIMD/GPU code path, I ran /cross-backend-diff and the worst ULP is ≤ 2. Not applicable.
• If I touched a feature extractor with SIMD/GPU twins, I either updated every twin or listed the gap under "Known follow-ups" below. Not applicable.
• If I added a new .c / .cpp / .cu / .h / .hpp, it has the appropriate license header (see CONTRIBUTING.md). Not applicable.
• If this is a breaking change, the commit message uses ! or BREAKING CHANGE: and the migration path is documented below. Not a breaking change.
• If this PR adds an ADR, the ADR row lives in docs/adr/_index_fragments/<NNNN-slug>.md and nothing else is touched for the index. No ADR.

Bug-status hygiene (ADR-0165)

• docs/state.md: T-GO-X-NET-GO-2026-6617-2026-10-09 added under Recently closed.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests, except by porting Netflix's own updated assertion verbatim from upstream (value and places as upstream has them, measured against the fork's CPU build first; ADR-1828).
• If I believe a golden value must change, I have explained why below AND pinged @lusoris for a CODEOWNERS exception. Not applicable.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: trivial dependency and toolchain bump.
• Decision matrix — no alternatives: only-one-way fix (the advisories' fixed versions).
• AGENTS.md invariant note — no rebase-sensitive invariants.
• Reproducer / smoke-test command — pasted below under "Reproducer".
• CHANGELOG fragment — changelog.d/security/go-x-net-0.60.0.md.
• Rebase note — no rebase impact: dependency, toolchain and base-image versions only.

Reproducer

go version                              # go1.27.2 (go.mod selects it; GOTOOLCHAIN=auto)
python3 scripts/ci/govulncheck-gate.py  # before: 13 reachable advisories on Go 1.27.1; after: OK, exit 0
go vet ./...
bash scripts/ci/check-base-image-single-source.sh
skopeo inspect --config docker://golang@sha256:2f84bc93ecfb2689f782b153fdcd368b5a7ab96c1386c65cdaccf35e726d6a44 | jq -r '.config.Env[]' | grep GOLANG_VERSION  # 1.27.2