chore(deps): update Go to v1.27.0

backend/internal/utils/callback_url_util.go

@@ -49,8 +49,8 @@ func validateCallbackURLPatternURL(pattern string) error {
 }
 
 func callbackURLPatternForURLParse(pattern string) string {
-	if strings.HasPrefix(pattern, "*://") {
-		pattern = "https://" + strings.TrimPrefix(pattern, "*://")
+	if after, ok := strings.CutPrefix(pattern, "*://"); ok {
+		pattern = "https://" + after
 	}
 
 	scheme, rest, ok := strings.Cut(pattern, "://")

backend/internal/utils/csp.go

@@ -37,14 +37,15 @@ func BuildFormPostCSP(nonce, redirectURI, scriptHash string) string {
 
 func buildCSP(nonce string, formActionExtra, scriptSrcExtra []string) string {
 	formAction := "'self'"
-	scriptSrc := "script-src 'self'"
+	var scriptSrc strings.Builder
+	scriptSrc.WriteString("script-src 'self'")
 	if nonce != "" {
-		scriptSrc += " 'nonce-" + nonce + "'"
+		scriptSrc.WriteString(" 'nonce-" + nonce + "'")
 	}
 
 	for _, extra := range scriptSrcExtra {
 		if extra != "" {
-			scriptSrc += " " + extra
+			scriptSrc.WriteString(" " + extra)
 		}
 	}
 
@@ -69,7 +70,7 @@ func buildCSP(nonce string, formActionExtra, scriptSrcExtra []string) string {
 		"img-src * blob:;" +
 		"font-src 'self'; " +
 		"style-src 'self' 'unsafe-inline'; " +
-		scriptSrc
+		scriptSrc.String()
 }
 
 // GenerateCSPNonce returns a random base64 nonce for use in a CSP header.