Go net/http 1.27

Apply the Go 1.27 prompt first. These rules cover the Go 1.27 standard-library HTTP server, client, router, file handlers, and reverse proxy. The standard library is updated by rebuilding with the toolchain; the included baseline governs its security updates.

Server limits and protocols

• Assign an explicit, fully wrapped handler to Server.Handler; nil selects DefaultServeMux, including routes registered by imported packages. Keep administrative handlers on a separately restricted listener.
• Size MaxHeaderBytes and MaxHeaderValueCount independently: zero selects defaults of 1 MiB and 500 values. Repeated header lines count separately, but comma-separated members of one line count once, except that Go 1.27.2 and later count each field a Trailer header declares; validate security-sensitive singleton headers separately.
• Configure Server.Protocols and Transport.Protocols deliberately. Enable SetUnencryptedHTTP2(true) only on an explicitly trusted, isolated connection path; it supplies neither TLS nor peer authentication. Review custom TLSNextProto and ConnectionState() tls.ConnectionState implementations because they affect ALPN protocol selection.
• Configure HTTP/2 through the native Protocols and HTTP2Config APIs where possible. If golang.org/x/net/http2 remains, audit both the module and the toolchain and check which implementation the build selects: current Go 1.27 wrappers delegate to net/http, while http2legacy and older module implementations need their own fixes. Replace deprecated h2c.NewHandler with Server.Protocols; wrap