Repository navigation
Upgrade to Go 1.27.3 - #5
Merged
Merged
Conversation
tnsardesai
marked this pull request as ready for review
November 2, 2026 18:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the repo from Go 1.27.2 to Go 1.27.3.
Go 1.27.3 is a security release with one fix:
crypto/x509stops trusting certificate chains through eight eMudhra intermediates whose private keys were compromised (CVE-2026-111943). Binaries built with go1.27.2 accept those chains whenever the CA bundle they run with predates the 2026-10-20 trust-store updates. There are no API or GODEBUG changes between 1.27.2 and 1.27.3.The latest release, v0.2.1 (2026-03-05), was built with go1.24.0, which is out of support. Cut a release after merging.
Changes
go.mod:go 1.27.2->go 1.27.3; CI and GoReleaser read the version fromgo.modgo mod tidychanged nothing else.Verification
go build ./...,go vet ./...andgo test -short ./...: 1/1 packages pass on unmodified go1.27.3, the same asmainon go1.27.2.gofmt -lreports the same files onmainwith go1.27.2 as with go1.27.3, so this change adds no formatting drift.Note
Low Risk
Single-line toolchain bump with no application code changes; risk is limited to using the patched Go release for builds.
Overview
Bumps the module’s declared Go version from 1.27.2 to 1.27.3 in
go.mod. CI and release workflows already take the toolchain from that file (go-version-file: go.mod), so they follow this bump without further edits.This is a patch-level security release (notably stricter
crypto/x509trust for compromised eMudhra intermediates, CVE-2026-111943). No dependency or source changes are in the diff.Reviewed by Cursor Bugbot for commit 28d013a. Bugbot is set up for automated code reviews on this repo. Configure here.