[oschwald]

STF-1864

mmdbverify rejects some valid databases that mmdbwriter writes. In these databases, a search-tree record points to a value nested in another data record (oschwald/maxminddb-golang#250). maxminddb-golang 2.7.0 fixes Reader.Verify() for these records (oschwald/maxminddb-golang#255).

Changes

• Update github.com/oschwald/maxminddb-golang/v2 to v2.7.0.
• Raise the Go requirement to 1.26, because maxminddb-golang 2.7.0 requires it:
  • go.mod: go 1.26.0
  • CI matrix: 1.26.x and 1.27.x
  • Release workflow: Go 1.27
  • .golangci.yml and README: 1.26
• Add a changelog entry for 1.1.0. It names the four behavior changes from maxminddb-golang 2.7.0.

The changelog uses the upstream release notes, not the ticket, in two places:

• It says extended type bytes 0 and 250 through 255. Byte 249 wrapped to kind 0, which the decoder already rejected.
• It names the new metadata-section check. The ticket does not mention it.

Testing

I made test databases from the reproducer in oschwald/maxminddb-golang#250:

Test database	v1.0.0	main (v2.6.0)	this branch
maxminddb-golang#250 reproducer	rejects ("found 1 pointers (of 2)…")	rejects	accepts
Extended type byte 0, no nested record	accepts	accepts	rejects ("unknown type: 263")

go build, go vet, and golangci-lint report no issues.

Release tooling

The release flow now matches the one that STF-1869 sets up for mmdbinspect. Immutable releases are on for this repo, so no one can add assets after a release is published. GoReleaser creates the release as a draft, uploads the assets, and then publishes it. The mmdbconvert v0.2.0 release failed with the flow that publishes first (maxmind/mmdbconvert@90ba45d).

• dev-bin/release.sh and README.dev.md: new. The script reads the first dated CHANGELOG.md section, then pushes the branch and an annotated tag with the notes.
• release.yml:
  • It waits for approval in the release environment.
  • It takes the release notes from the tag, and it stops if the tag is not annotated or has no notes.
  • It uses Go stable.
• release.yml: a new goreleaser-check job runs a snapshot release on PRs and pushes to main, as mmdbconvert does.
• .goreleaser.yml: name_template replaces target_commitish, as in mmdbconvert.

Lint config

• Update golangci-lint to 2.14.0. Migrate the config to gomodguard_v2 and gofumpt extra.group-params, and disable exhaustruct_v5. These go in one commit, because each change fails lint without the other.
• Sync the rules with mmdbconvert. This removes the geoipupdate md5 exclusion (G401, G501) and allows a switch with no default. .golangci.yml now differs from mmdbconvert's only in the module path and the go target.

Release tooling tests

• shellcheck, shfmt, zizmor, prettier, and goreleaser check pass.
• A local goreleaser release --snapshot --clean --skip=publish built all 10 archives and packages.
• The notes from the dated 1.1.0 section make it through a round trip in an annotated tag exactly, ### headings included (--cleanup=verbatim).
• The notes step exits 1 for an annotated tag with no body and for a lightweight tag.

Before release

The release environment does not exist in this repo yet. The environments are managed in Terraform (ENG-4134). If a workflow names an environment that does not exist, GitHub creates it with no protection. So the environment must exist before the first tag push.

After that, add today's date to the 1.1.0 heading and run dev-bin/release.sh.

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6964a2dd-e734-42a9-9e17-06dd10cd020f

📥 Commits

Reviewing files that changed from the base of the PR and between efd81e6 and 7d605a5.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (6)

• .github/workflows/go.yml
• .github/workflows/release.yml
• .golangci.yml
• CHANGELOG.md
• README.md
• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The repository now specifies Go 1.26 or later, and its workflows use Go 1.26 and 1.27. The module dependencies are upgraded. The changelog adds v1.1.0 notes and updates its release links.

Changes

Go version and v1.1.0 release

Layer / File(s)	Summary
Go baseline, CI, and module versions go.mod, README.md, .github/workflows/go.yml, .github/workflows/release.yml, .golangci.yml	The module and source-build requirement now specify Go 1.26. The test matrix uses Go 1.26 and 1.27, the release workflow uses Go 1.27, and golangci-lint uses Go 1.26. The MaxMind DB module and golang.org/x/sys are upgraded.
v1.1.0 release notes and links CHANGELOG.md	The changelog adds v1.1.0 notes about the Go requirement and mmdbverify validation, and updates the unreleased comparison and v1.1.0 release links.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 7d605

The Go 1.26+ build requirement is consistent across the documented and configured paths, and the verifier update supports the described database-validation behavior. No actionable merge-blocking regression is evident.

Architecture Summary

Architecture risk: 🔵 Low · up to 7d605

The change affects 3 systems.

Changed systems: CHANGELOG.md, go.mod, README.md

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — CHANGELOG.md (service) was modified; 1 changed file maps to changed impact.
• observed — go.mod (service) was modified; 1 changed file maps to changed impact.
• observed — README.md (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in CHANGELOG.md: Adds the 1.1.0 changelog entry: Go 1.26 or later is required to build from source; mmdbverify rejects the listed extended type bytes, data pointers into field interiors, invalid metadata pointers, and invalid data after the metadata map; and it accepts search-tree records pointing to values nested in another data record.
• observed — Modified behavior in CHANGELOG.md: Updates the unreleased comparison link from v1.0.0 to v1.1.0 and adds the v1.1.0 release link.
• observed — Modified behavior in README.md: The Go Version badge now specifies Go 1.26+ instead of Go 1.25+.
• observed — Modified behavior in README.md: The source-build requirement now specifies Go 1.26 or later instead of Go 1.25 or later.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: updating maxminddb-golang to v2.7.0 to include the nested-record Verify fix.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the Go version line,
Then hops through modules, neat and fine.
The changelog gains a release note,
With validation points to quote.
One last hop, the links align!}

_{Comment @coderabbitai help to get the list of available commands.}