chore(deps): bump golang from 1.26.6-alpine to 1.27.1-alpine in the docker group across 1 directory

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the docker group with 1 update in the / directory: golang.

Updates golang from 1.26.6-alpine to 1.27.1-alpine

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[reinkrul]

There's actual JSON unmarshalling bugs

[stevenvegt]

Why the e2e job fails: Go 1.27 breaks go-did's CredentialStatus unmarshalling

The redis e2e test fails at "Could not issue NutsOrganizationCredential to node-B" with curl: (52) Empty reply from server. The node-B backend container crashed while handling that request with fatal error: stack overflow (about 4 million frames of (*CredentialStatus).UnmarshalJSON calling json.Unmarshal calling itself), triggered from VerifiableCredential.CredentialStatuses inside the NutsOrganizationCredential validator on IssueVC.

Root cause

Go 1.27 backs encoding/json with encoding/json/v2 by default (release notes: https://go.dev/doc/go1.27, opt out with GOEXPERIMENT=nojsonv2). go-did v0.22.0 (and go-did master at the time of writing) implements the method as:

// go-did vc/vc.go:202
func (cs *CredentialStatus) UnmarshalJSON(input []byte) error {
	type alias *CredentialStatus
	a := alias(cs)
	err := json.Unmarshal(input, a)
	...

Under the v1 decoder a named pointer type has no methods, so the decoder walked through to the struct and this worked. The v2-backed decoder resolves the UnmarshalJSON method on the pointed-to struct again and calls the same method, which recurses forever. Every credential carrying a credentialStatus now crashes the node.

Reproduction

A minimal module that only calls json.Unmarshal into vc.CredentialStatus passes with Go 1.26.5 and dies with fatal error: stack overflow under GOTOOLCHAIN=go1.27.1 go test. Unit tests in this repo do not catch it because the test job builds with the go.mod toolchain (1.26.x); only the Docker build picks up the image's Go 1.27.

Fix

1. In go-did, replace the pointer alias with a value alias and copy the fields back, for example:

   type alias CredentialStatus
   var a alias
   if err := json.Unmarshal(input, &a); err != nil {
   	return err
   }
   *cs = CredentialStatus(a)

   The other type alias X / type Alias X sites in go-did (VerifiableCredential, VerifiablePresentation, Document, VerificationRelationship) already use value types and are fine.

2. Release go-did and bump it here (go.mod currently pins v0.22.0), then re-run this PR.

3. Worth a grep in this repo for type .*[aA]lias \* before bumping the Go image; I found no occurrences on master.

The same bump will hit V6.2 and V5.4 when their Go image is raised, so the go-did bump should go to those branches as well.

[stevenvegt]

Superseded by #4505

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

[stevenvegt]

Follow-up: the go-did fix is in nuts-foundation/go-did#163, and #4505 carries this same Dockerfile bump plus the test fixes needed for Go 1.27 (a second, non-JSON issue: pkix.Name.String formatting changed, which broke the denylist tests). The e2e job passes on #4505 with go-did pinned to the fix commit. Once go-did v0.22.1 is released and #4505 is switched to the tag, #4505 can replace this PR.