chore: adapt to go 1.27

Restore the toolchain pin renovate dropped. The go directive has to lose
its patch version for that: go removes a toolchain equal to it, and every
go command then refuses to run until go.mod is tidied.

Go 1.27 changes the flate encoder, so the sizes and checksums pinned by
package tests move with the compressed output. Hash the avatar test input
directly instead of a png, which has no bearing on what it asserts.

encoding/json v2 is no longer an experiment, so drop the v1 implementation
and GOEXPERIMENT=jsonv2 with it.

Assisted-by: Claude Code:Opus 5

modules/avatar/federated.go

@@ -16,11 +16,11 @@ import (
 
 // LookupFederatedHost returns the avatar host from the email domain's SRV record. https://wiki.libravatar.org/api/
 func LookupFederatedHost(ctx context.Context, email string, secure bool) string {
-	at := strings.LastIndexByte(email, '@')
-	if at < 0 {
+	_, domain, found := strings.CutLast(email, "@")
+	if !found {
 		return ""
 	}
-	domain := strings.ToLower(email[at+1:])
+	domain = strings.ToLower(domain)
 
 	service, defaultPort := "avatars", uint16(80)
 	if secure {

modules/avatar/hash_test.go

@@ -4,9 +4,6 @@
 package avatar_test
 
 import (
-	"bytes"
-	"image"
-	"image/png"
 	"testing"
 
 	"gitea.dev/modules/avatar"
@@ -15,12 +12,10 @@ import (
 )
 
 func Test_HashAvatar(t *testing.T) {
-	myImage := image.NewRGBA(image.Rect(0, 0, 32, 32))
-	var buff bytes.Buffer
-	png.Encode(&buff, myImage)
+	data := []byte("data")
 
-	assert.Equal(t, "9ddb5bac41d57e72aa876321d0c09d71090c05f94bc625303801be2f3240d2cb", avatar.HashAvatar(1, buff.Bytes()))
-	assert.Equal(t, "9a5d44e5d637b9582a976676e8f3de1dccd877c2fe3e66ca3fab1629f2f47609", avatar.HashAvatar(8, buff.Bytes()))
-	assert.Equal(t, "ed7399158672088770de6f5211ce15528ebd675e92fc4fc060c025f4b2794ccb", avatar.HashAvatar(1024, buff.Bytes()))
+	assert.Equal(t, "912b5d144e1f82719c79d4014fd9dc075aea506be410fb782d50c4f299f845f4", avatar.HashAvatar(1, data))
+	assert.Equal(t, "55e41725707388f35483f881b2f38405fd9a6883365a862b8a5350ed6737c6fe", avatar.HashAvatar(8, data))
+	assert.Equal(t, "473f06c83edcf69a9122db1d32f7649ebaa2680678e20ed0f868d25bd272abe8", avatar.HashAvatar(1024, data))
 	assert.Equal(t, "161178642c7d59eb25a61dddced5e6b66eae1c70880d5f148b1b497b767e72d9", avatar.HashAvatar(1024, []byte{}))
 }

modules/git/key.go

@@ -55,12 +55,12 @@ func GetSigningKey(ctx context.Context) (*SigningKey, *Signature) {
 		}
 
 		return &SigningKey{
-				KeyID:  strings.TrimSpace(signingKey),
-				Format: strings.TrimSpace(format),
-			}, &Signature{
-				Name:  strings.TrimSpace(signingName),
-				Email: strings.TrimSpace(signingEmail),
-			}
+			KeyID:  strings.TrimSpace(signingKey),
+			Format: strings.TrimSpace(format),
+		}, &Signature{
+			Name:  strings.TrimSpace(signingName),
+			Email: strings.TrimSpace(signingEmail),
+		}
 	}
 
 	if setting.Repository.Signing.SigningKey == "" {
@@ -68,10 +68,10 @@ func GetSigningKey(ctx context.Context) (*SigningKey, *Signature) {
 	}
 
 	return &SigningKey{
-			KeyID:  setting.Repository.Signing.SigningKey,
-			Format: setting.Repository.Signing.SigningFormat,
-		}, &Signature{
-			Name:  setting.Repository.Signing.SigningName,
-			Email: setting.Repository.Signing.SigningEmail,
-		}
+		KeyID:  setting.Repository.Signing.SigningKey,
+		Format: setting.Repository.Signing.SigningFormat,
+	}, &Signature{
+		Name:  setting.Repository.Signing.SigningName,
+		Email: setting.Repository.Signing.SigningEmail,
+	}
 }

modules/json/jsonlegacy.go

@@ -1,25 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !goexperiment.jsonv2
-
-package json
-
-import (
-	"encoding/json" //nolint:depguard // this package wraps it
-	"io"
-)
-
-func getDefaultJSONHandler() Interface {
-	return jsonV1{}
-}
-
-func MarshalKeepOptionalEmpty(v any) ([]byte, error) {
-	return DefaultJSONHandler.Marshal(v)
-}
-
-func NewDecoderCaseInsensitive(reader io.Reader) Decoder {
-	return DefaultJSONHandler.NewDecoder(reader)
-}
-
-type Value = json.RawMessage

modules/json/jsonv1.go

@@ -1,38 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package json
-
-import (
-	"bytes"
-	"encoding/json" //nolint:depguard // this package wraps it
-	"io"
-)
-
-type jsonV1 struct{}
-
-var _ Interface = jsonV1{}
-
-func (jsonV1) Marshal(v any) ([]byte, error) {
-	return json.Marshal(v)
-}
-
-func (jsonV1) MarshalWrite(w io.Writer, v any) error {
-	return json.NewEncoder(w).Encode(v)
-}
-
-func (jsonV1) Unmarshal(data []byte, v any) error {
-	return json.Unmarshal(data, v)
-}
-
-func (jsonV1) NewEncoder(writer io.Writer) Encoder {
-	return json.NewEncoder(writer)
-}
-
-func (jsonV1) NewDecoder(reader io.Reader) Decoder {
-	return json.NewDecoder(reader)
-}
-
-func (jsonV1) Indent(dst *bytes.Buffer, src []byte, prefix, indent string) error {
-	return json.Indent(dst, src, prefix, indent)
-}

modules/json/jsonv2.go

@@ -1,8 +1,6 @@
 // Copyright 2025 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-//go:build goexperiment.jsonv2
-
 package json
 
 import (
@@ -14,7 +12,6 @@ import (
 )
 
 // JSONv2 implements Interface via encoding/json/v2
-// Requires GOEXPERIMENT=jsonv2 to be set at build time
 type JSONv2 struct {
 	marshalOptions                  jsonv2.Options
 	marshalKeepOptionalEmptyOptions jsonv2.Options

modules/packages/alpine/metadata_test.go

@@ -95,7 +95,7 @@ func TestParsePackage(t *testing.T) {
 		assert.NoError(t, err)
 		assert.NotNil(t, p)
 
-		assert.Equal(t, "Q1SRYURM5+uQDqfHSwTnNIOIuuDVQ=", p.FileMetadata.Checksum)
+		assert.Equal(t, "Q1GfcV5dUrPr1xIRekqPYGehdxjL8=", p.FileMetadata.Checksum)
 	})
 }
 

modules/validation/helpers.go

@@ -64,12 +64,12 @@ func IsEmailDomainListed(globs []glob.Glob, email string) bool {
 		return false
 	}
 
-	n := strings.LastIndex(email, "@")
-	if n <= 0 {
+	localPart, domain, found := strings.CutLast(email, "@")
+	if !found || localPart == "" {
 		return false
 	}
 
-	domain := strings.ToLower(email[n+1:])
+	domain = strings.ToLower(domain)
 
 	for _, g := range globs {
 		if g.Match(domain) {