go.mod: Go 1.16

[meowsbits]

Bump module Go version from 1.13 (released 2019/09/03) to 1.16 (released 2021/02/16).

https://golang.org/doc/devel/release.html

CI builder versions were bumped to 1.16 with c5023e1.

[meowsbits]

I have been doing a little research (timely, I know) on how exactly the Go version number is supposed to be used.

In short,

The language version determines which language features are available when compiling packages in the module.

• https://golang.org/ref/mod#go-mod-file-go

(a caveat):

• go 1.15.5 won't work; invalid go version '1.15.5': must match format 1.23

"It implies to me the minimum version of Go for the project". Following this logic, then it seems like go1.13 is acceptable, since that version introduced Error wrapping which is used here, and that's the latest "feature" I'm aware of that's differentiable at this repo.

Now, I'm not sure if the Go vulnerability fixed with 1.15.5 counts as a "language feature" (probably not?), but the relevance of that patch here may be a good reason to "strongly suggest" the latest go-mod-allowed version subsequent to it, namely go 1.16. In this case the minimum version of Go is defined by application safety (related to a language bug), rather than language feature utilization.

## Vulnerable to GETH-2020-02 (GoCrash)

Severity: Critical
Summary : A denial-of-service issue can be used to crash Geth nodes during block processing, due to an underlying bug in Go (CVE-2020-28362) versions < `1.15.5`, or `<1.14.12`
Fixed in: v1.9.24
References:
	- https://blog.ethereum.org/2020/11/12/geth_security_release/
	- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
	- https://github.com/golang/go/issues/42552

Note that setting go1.16 won't necessarily prevent users from building with lower Go versions (until, and if, language features prohibiting it were used in the application, eg. go embed).

• https://golang.org/doc/go1.12#modules
• https://blog.golang.org/using-go-modules
• params: release Geth v1.9.24 with Go 1.15.5 #21842
• https://blog.ksub.org/bytes/2019/09/15/go.mods-go-directive/
• https://www.reddit.com/r/golang/comments/b0b8k3/what_version_should_the_gomod_go_directive_be_set/

[holiman]

Makes sense to me ... @fjl?

[fjl]

I'm not sure about this.

[karalabe]

We really don't see any reason to start playing with whatever language syntax enforcement this field provides. If you can build it with old versions, great. If we'll use something newer and old builds fail, you're gonna see it.