go1.17.8 (released 2022-03-03) includes a security fix to the regexp/syntax package, as well as bug fixes to the compiler, runtime, the go command, and the crypto/x509 and net packages. See the Go 1.17.8 milestone on our issue tracker for details.
Thanks for explaining that bonus value depends on the terms rather than the headline amount. That is the part I always check first now.