[wu-sheng]

Go 1.25 reached end of life with the Go 1.27 release. This PR moves every module to go 1.26.0, tests on Go 1.26 and Go 1.27, verifies every plugin's hook points against new framework versions, and sets new verified version ranges.

Go versions

• go 1.26.0 in every project module. The floor is not 1.27, because the agent's go directive becomes the minimum for every application that imports it, and Go 1.26 is still supported upstream.
• CI, images and docs: the build matrix, plugin and e2e jobs, Windows job and base images move to go1.26 / go1.27.
• Dependencies: golang.org/x/net v0.61.0 closes the HTTP/2 advisories that Bump grpc to v1.83.2 and x/net to v0.58.0 to fix known CVEs #258 left open, together with x/text v0.43.0 and the other x/* modules.
• golangci-lint v2.15.0, installed from https://golangci-lint.run/install.sh. Older copies of the install script pick the SBOM checksum and fail for every release since v2.12.2.

Hook-point verification

• Signatures: compared at the lowest and highest supported version of every framework, using the agent's own plugin registry and matcher. 105 of 107 hook points are identical. The other two are dubbo's protocol → base type aliases.
• External audit: every plugin was audited by an external model (hook placement and span correctness), and its findings were verified against source.
  • Findings that affect the new ranges are fixed here (see Plugins).
  • The remaining findings describe long-standing plugin behavior and will be handled after this PR.
• Instrumented builds: each changed plugin was compiled with the agent at both ends of its range. Only the hooked package's direct imports are available to the copied interceptors, which is what broke dubbo v3.3.1.

Test harness fixes

• Plugin test cases now build with GOWORK=off. Minimal version selection across go.work lifted the framework to the newest version required by any plugin or scenario module, so about two thirds of the cases did not build the version they were named after.
• go-elasticsearch and goframe: the scenarios declare the full module path (/v8, /v2), so their version matrix applies.
• cross-goroutine: now uses the local toolkit.
• kratosv2: runs in CI again.
• fail-fast: false: one failing scenario no longer cancels the others.
• dubbo: the scenario's proto file got a unique name, because dubbo-go v3.3.1 pulls in another api.proto.

Plugins

• grpc ≥ v1.84.0: handled by a new plugins/grpc-v184, which reports the same spans as before.
• dubbo-go ≥ v3.3.1: handled by a new plugins/dubbo-v331, since v3.3.1's graceful-shutdown filter imports protocol/base and protocol/result instead of protocol.
  • The existing plugins keep older releases, plus builds whose version cannot be detected.
  • Each pair shares its plugin name, so exclusion config is unchanged.
  • On v3.3.1 the Triple provider runs on net/http, so its entry span is created by the http plugin.
• amqp: also intercepts PublishWithDeferredConfirm, which Publish and PublishWithContext go through since amqp091-go v1.10.0. Injected headers now reach messages published with nil Headers.
• go-redis: no longer traces the connection setup commands that run through the client hooks since v9.9.0. HELLO and AUTH exported the password in span tags. The same commands are also skipped when the application sends them itself.
• zap: reports after the pre-write hooks added in v1.28.0.
• logrus: no longer panics on entries with nil Data (v1.10.0+).
• New verified ranges are in docs/en/agent/support-plugins.md. CHANGES.md lists every version that is no longer supported and why. None of them was dropped because Go 1.26 cannot build it.

Agent binary

govulncheck reports no reachable third-party advisories in skywalking-go-agent (go-git, go-billy, circl and amqp091-go were fixed).

Review by an external model

The squashed diff was reviewed by an external model (read-only source review). I verified each finding against the framework source:

• grpc-v184: a second response message on a unary or client-streaming RPC is now reported. grpc v1.84 raises the cardinality error outside the hooked RecvMsg and does not finish the stream, so the plugin marks the receive span and the stream's exit span with the error and finishes the stream span once. Unit tests cover both cases.
• go-redis: CLIENT TRACKING, sent during connection setup when client-side caching is enabled, is filtered with the other setup commands.
• dubbo docs: the Triple protocol already serves on net/http in v3.3.0. The docs no longer date that change to v3.3.1.
• Known limitation, unchanged from main: a framework replaced by a local module reports no version, so the existing plugins/grpc / plugins/dubbo is used. A local dubbo-go v3.3.1+ therefore does not compile with the agent, which is the same as before this PR. Choosing the plugin from the package source instead of the version needs an agent change, and is left for a follow-up.

Verification

• Lint: clean on all modules.
• Tests: go test passes in all 36 modules on Go 1.26.9.
• Local scenario runs: grpc (v1.83.2, v1.84.0), dubbo (v3.0.2, v3.3.1), amqp (v1.9.0, v1.15.0, plus v1.15.0 on Go 1.27), go-redis (v9.0.4, v9.0.5, v9.23.0, plus v9.23.0 on Go 1.27), gin and http.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ej1HubxqebgChKygA5TTHP