GeezerVison

Stacked on #1383. Brings the toolchain and every dependency current ahead of the 8.1.2687 release, and cuts the changelog section for it.

Changes

• Go 1.27.3 (mise.toml, both go.mod, dev/vendor-lib.sh, Docker builder images); Alpine 3.24 runtime images.
• go get -u ./... + go mod tidy in the root and lib/ modules, same approach as Bump Go dependencies to latest #1354. Three deliberate pins:
  • github.com/derision-test/glock v1.1.4: v1.1.5's MockTicker can deliver two ticks for one BlockingAdvance, which panics internal/batches/watchdog tests (sync: negative WaitGroup counter). Same pin and comment as Bump Go dependencies to latest #1354.
  • github.com/gobwas/glob v0.2.3: v1 is a rewrite with different matching semantics; lib/ mirrors the monorepo's pin and batch spec globs are user-facing.
  • k8s.io/kube-openapi at the revision k8s.io/apimachinery v0.37.2 requires; the newest pulls conflicting structured-merge-diff majors.
• src snapshot upload uses option.WithAuthCredentialsFile(option.ServiceAccount, …); the old WithCredentialsFile is deprecated. The credentials file Sourcegraph issues is a service account key, so no change for customers.
• go fix ./... run twice in both modules (Go 1.27 modernizers), same approach as go: upgrade to Go 1.26 and modernize #1348 / go: upgrade to Go 1.26 and modernize #1349, plus the two leftovers lint flags: fmt.Fprintf in curlCmd and the inlined boolPtr test helper removed.
• GitHub Actions: checkout v7, setup-node v7 with Node 26.13.0, setup-qemu v4, setup-buildx v4. goreleaser-action stays on v5 on purpose: v6+ installs goreleaser v2, which rejects .goreleaser-patch.yml (tap/folder were removed in v2) and fails check on the v1 config. Migrating to goreleaser v2 is a separate change.
• golangci-lint 2.15.0, shfmt 3.14.1, shellcheck 0.11.0.
• SCIP workflow: go install github.com/scip-code/scip-go/cmd/[email protected] with the job's Go toolchain, replacing container: sourcegraph/scip-go. That Docker Hub image stopped at v0.1.26 (built with Go 1.26) and fails on Go 1.27 builds with nil module for userland package: uuid, because database/sql now imports the new stdlib uuid package. The newer ghcr.io/scip-code/scip-go nix image can't host JS actions (actions/checkout fails with exec /__e/node24/bin/node: no such file or directory), so the indexer is installed into the runner instead, the same way sourcegraph/scip-go-action@v2 does.
• CHANGELOG.md: unreleased entries moved under ## 8.1.2687. DEVELOPMENT.md: later 8.1.x patch numbers must stay above 2687.

Tested

• go build, go vet, ./dev/go-lint.sh (0 issues), Trivy exit 0 at all severities.
• go test -race ./... and go test ./... green in both modules.
• goreleaser check passes under goreleaser 1.26.2 (what the action installs).
• Built src from main and from this branch: every src <cmd> -h page (45) and every src doc file (76) are byte-identical, so the generated reference docs do not change.
• Read-only commands against sourcegraph.sourcegraph.com produce identical output between the two builds: version, login, search (text and -json), repos list/get, orgs list, users list, extsvc list, search-jobs list, config get, api (including -get-curl), batch validate, batch repositories.
• Not exercised: batch execution (no Docker on the test machine) and snapshot upload against a real bucket.