[the-medo]

Updates the Go toolchain, backend modules, and development tooling, and removes outdated frontend transitive dependencies. Backend vulnerability checking reports no reachable vulnerabilities; the frontend recursive audit falls from 86 unique security advisories (6 critical) to 2, with zero findings in the production-dependency audit.

Changes

• Align backend builds, CI, and worktree development on Go 1.27.3; update production Alpine to 3.24 and refresh Go modules.
• Migrate the Cloudflare SDK to v7, PASETO imports to v2, and GoMock to the maintained Uber fork. Add regression coverage for Cloudflare multipart uploads/error handling and tokens issued by the previous PASETO library.
• Pin sqlc 1.31.1 and regenerate database code and mocks. sqlc changes only its generator headers; SQL queries and generated types remain unchanged.
• Update GitHub Actions and Mailpit to 1.31.6. The manual deployment workflow selects the latest kubectl patch matching the actual EKS minor version, replacing the obsolete fixed client version.
• Replace next-svgr with @svgr/webpack 8.1.0, share SVG configuration between Next.js and Storybook, align import types, and add an SVG regression story.
• Refresh and deduplicate the Yarn lockfile and apply a scoped webpack-dev-middleware 8.5.0 resolution for Storybook's path-traversal fix. Document the override and remaining findings in the frontend README.

Validation

Passed locally:

• Backend short test suite, Go build, module verification/tidiness, generator installation/regeneration, govulncheck, and production Docker image build.
• Migrations against existing and fresh worktree databases; live signup, queued email delivery, verification, login, password reset, logout, CORS, and cross-worktree isolation. Existing inbox messages survived the Mailpit upgrade.
• Frontend immutable installation, lint, formatting, application/Storybook type checks, Next.js and Storybook production builds, and unchanged API client regeneration.
• Browser login and listing routes, SVG component/image rendering in Next.js, all 33 Storybook entries and interaction tests, and live hot updates through the upgraded middleware.
• Actionlint, Bash/Python syntax checks, concurrent-worktree lifecycle integration tests, nine kubectl-version selection fixtures, and git diff --check.

Remaining findings and limits

• Frontend: braces (high) and elliptic (low) have no published fixes. Both arrive through Storybook; configured glob patterns are repository-controlled, and the application does not use the crypto polyfills to sign data. These package files are absent from all 66 Next production trace manifests. Three Storybook transitive deprecation notices also remain. No audit exclusions were added.
• Backend: the module-only GO-2026-5932 advisory concerns unimported golang.org/x/crypto/openpgp; there are no advisories in imported packages or reachable vulnerable calls.
• Cloudflare integration was checked with an HTTP stub. The live AWS deployment path was not executed, and no production deployment was performed.