chore(build): bump Go toolchain to 1.27.0

Go 1.27.0 shipped on 2026-08-19. Raise the go directive and the builder
image so Docker and release builds pick it up; every CI job already reads
the version from go.mod, and golangci-lint v2.13.1 release binaries are
themselves built with go1.27.0, so the lint job needs no pin change.

internal/web/controller/api.go

@@ -155,11 +155,11 @@ func (a *APIController) enforceTokenScope(c *gin.Context) {
 
 func relAPIPath(fullPath string) string {
 	const marker = "/panel/api"
-	i := strings.Index(fullPath, marker)
-	if i < 0 {
+	_, after, ok := strings.Cut(fullPath, marker)
+	if !ok {
 		return ""
 	}
-	return fullPath[i+len(marker):]
+	return after
 }
 
 // initRouter sets up the API routes for inbounds, server, and other endpoints.

internal/web/job/ip_limit_allowlist.go

@@ -2,6 +2,7 @@ package job
 
 import (
 	"net/netip"
+	"slices"
 	"strings"
 )
 
@@ -16,7 +17,7 @@ type ipLimitAllowlist struct {
 // skipped: the validator uses these same rules, so only a hand-edited DB differs.
 func parseIpLimitAllowlist(raw string) ipLimitAllowlist {
 	var list ipLimitAllowlist
-	for _, field := range strings.Split(raw, ",") {
+	for field := range strings.SplitSeq(raw, ",") {
 		field = strings.TrimSpace(field)
 		if field == "" {
 			continue
@@ -52,10 +53,8 @@ func (l ipLimitAllowlist) contains(ip string) bool {
 		return false
 	}
 	addr = addr.Unmap()
-	for _, allowed := range l.addrs {
-		if allowed == addr {
-			return true
-		}
+	if slices.Contains(l.addrs, addr) {
+		return true
 	}
 	for _, prefix := range l.prefixes {
 		if prefix.Contains(addr) {

internal/web/network/auto_https_conn.go

@@ -46,8 +46,8 @@ func (c *AutoHttpsConn) readRequest() bool {
 	}
 	resp := http.Response{
 		Header: http.Header{},
-	}
-	resp.StatusCode = http.StatusTemporaryRedirect
+
+		StatusCode: http.StatusTemporaryRedirect}
 	location := fmt.Sprintf("https://%v%v", request.Host, request.RequestURI)
 	resp.Header.Set("Location", location)
 	_ = resp.Write(c.Conn)

internal/web/service/client_external_link_test.go

@@ -7,10 +7,6 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 )
 
-func externalLinkBool(v bool) *bool {
-	return &v
-}
-
 func TestSetExternalLinksPersistsEnableState(t *testing.T) {
 	setupBulkDB(t)
 	db := database.GetDB()
@@ -22,8 +18,8 @@ func TestSetExternalLinksPersistsEnableState(t *testing.T) {
 	}
 
 	if err := svc.SetExternalLinksForRecord(rec.Id, []ExternalLinkInput{
-		{Kind: model.ExternalLinkKindLink, Value: "trojan://pw@example.com:443#on", Remark: "Primary", Enable: externalLinkBool(true), ExpiryTime: 1767225600000},
-		{Kind: model.ExternalLinkKindSubscription, Value: "https://provider.example/sub", Remark: "Provider", Enable: externalLinkBool(false), NamePrefix: "[zjh] "},
+		{Kind: model.ExternalLinkKindLink, Value: "trojan://pw@example.com:443#on", Remark: "Primary", Enable: new(true), ExpiryTime: 1767225600000},
+		{Kind: model.ExternalLinkKindSubscription, Value: "https://provider.example/sub", Remark: "Provider", Enable: new(false), NamePrefix: "[zjh] "},
 		{Kind: model.ExternalLinkKindLink, Value: "trojan://pw@example.net:443#default"},
 	}); err != nil {
 		t.Fatalf("set external links: %v", err)
@@ -76,7 +72,7 @@ func TestSetExternalLinksPreservesFetchStatus(t *testing.T) {
 	}
 
 	if err := svc.SetExternalLinksForRecord(rec.Id, []ExternalLinkInput{
-		{Kind: row.Kind, Value: row.Value, Remark: "new", Enable: externalLinkBool(true)},
+		{Kind: row.Kind, Value: row.Value, Remark: "new", Enable: new(true)},
 	}); err != nil {
 		t.Fatalf("set external links: %v", err)
 	}

internal/web/service/client_test.go

@@ -4,15 +4,14 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 	"github.com/mhsanaei/3x-ui/v3/internal/xray"
 )
 
 func TestClientWithAttachmentsMarshalJSONIncludesExtras(t *testing.T) {
 	c := ClientWithAttachments{
-		ClientRecord: model.ClientRecord{Id: 1, Email: "alice@example.com"},
-		InboundIds:   []int{3, 5},
-		Traffic:      &xray.ClientTraffic{Email: "alice@example.com", Up: 1024, Down: 4096, Enable: true},
+		Id: 1, Email: "alice@example.com",
+		InboundIds: []int{3, 5},
+		Traffic:    &xray.ClientTraffic{Email: "alice@example.com", Up: 1024, Down: 4096, Enable: true},
 	}
 	out, err := json.Marshal(c)
 	if err != nil {
@@ -39,8 +38,8 @@ func TestClientWithAttachmentsMarshalJSONIncludesExtras(t *testing.T) {
 
 func TestClientWithAttachmentsMarshalJSONOmitsAbsentTraffic(t *testing.T) {
 	c := ClientWithAttachments{
-		ClientRecord: model.ClientRecord{Id: 1, Email: "bob@example.com"},
-		InboundIds:   nil,
+		Id: 1, Email: "bob@example.com",
+		InboundIds: nil,
 	}
 	out, err := json.Marshal(c)
 	if err != nil {

internal/web/service/inbound_autorenew_calendar_test.go

@@ -118,7 +118,7 @@ func TestAutoRenewClients_CalendarModeClampsShortMonths(t *testing.T) {
 func firstBillingMidnightAfter(t *testing.T, from time.Time, day int, loc *time.Location) time.Time {
 	t.Helper()
 	cur := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, loc)
-	for i := 0; i < 400; i++ {
+	for range 400 {
 		cur = cur.AddDate(0, 0, 1)
 		want := day
 		if last := time.Date(cur.Year(), cur.Month()+1, 0, 0, 0, 0, 0, loc).Day(); want > last {

internal/web/service/setting_mtls_test.go

@@ -187,7 +187,7 @@ func TestEnsureMasterClientCertConcurrentFirstUseMintsOneCredential(t *testing.T
 	}
 	close(start)
 	var first crypto.CertKeyPEM
-	for i := 0; i < callers; i++ {
+	for i := range callers {
 		credential := <-results
 		if err := <-errs; err != nil {
 			t.Fatalf("caller %d: %v", i, err)