Build with Go 1.27.1, update dependencies, add make check

[kevinmcconnell]

Summary

• Build with Go 1.27.1
• Update dependencies: klauspost/compress v1.19.2 -> v1.20.0, stretchr/testify v1.8.4 -> v1.12.1. x/crypto and x/net are already current. The testify update replaces six old indirect modules with go.yaml.in/yaml/v3, which also covers the open dependabot PR for testify.
• Add a make check target that runs go vet and govulncheck. govulncheck is added as a module tool via the tool directive in go.mod, so its version is pinned and it runs with go tool govulncheck.

Verification

• go build ./..., go vet ./..., make test (also with -race) pass.
• golangci-lint run reports 0 issues.
• make dist builds all four linux/darwin targets.
• make check passes. govulncheck finds 0 vulnerabilities in the code. It reports one advisory in a required module (GO-2026-5932, the unmaintained x/crypto/openpgp package), which Thruster does not import and which has no fixed version.
• Ran the built binary in front of a small upstream and confirmed a proxied request returns 200 with an X-Request-Id header.

[Copilot]

🟢 Approval recommended

The dependency versions are valid and the build and validation updates are internally consistent.

Pull request overview

Updates Thruster’s Go toolchain, dependencies, and local validation tooling.

Changes:

• Requires Go 1.27.1 and updates dependencies.
• Pins govulncheck as a module tool.
• Adds make check for vetting and vulnerability scanning.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
Makefile	Adds the check target.
go.mod	Updates Go, dependencies, and tool configuration.
go.sum	Refreshes checksums for the updated module graph.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.