[kush2shah-agent]

Summary

Require Go 1.27.3, which includes the crypto/x509 mitigation for compromised eMudhra intermediate CA certificates (CVE-2026-111943).

• Raise the go.mod minimum from 1.26.6 to 1.27.3. Existing CI and release jobs already read go-version-file: go.mod, so both pick up the patched toolchain.
• Align the source Docker builder with golang:1.27.3-alpine; do not leave the separate Docker build path on the old minor series.
• Correct the contributor prerequisite and document why existing binaries/images need rebuilding.

Sources:

• Go security announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek
• Go issue: https://go.dev/issue/82345
• Incident: https://emudhra.we-have-a-problem.com/

Scope and rollout

This is a toolchain update, including the requested upgrade to the Go 1.27 series; no API, authentication, output, or certificate-verification overrides are introduced. The fix belongs in Go's verifier rather than custom application-level CA filtering.

The GoReleaser container copies the release-built executable, so it gets the mitigation through the release toolchain. Both runtime Dockerfiles already install ca-certificates; this change does not claim an unverified Alpine package version or replace that trust store manually.

After merge, maintainers must publish a new release/rebuild the images. The existing release workflow opens the Homebrew formula update. This PR does not alter already published assets, issue a release, or change the separate tap repository.

Verification

Run locally with go version go1.27.3 darwin/arm64:

• make test — passed (full suite).
• go vet ./... — passed.
• go run github.com/golangci/golangci-lint/v2/cmd/[email protected] run ./... — passed, 0 issues.
• go run golang.org/x/vuln/cmd/[email protected] ./... — no reachable vulnerabilities; one module-only finding, not in imported packages.
• Native CLI build — passed; go version -m confirms Go 1.27.3.
• CGO_ENABLED=0 Linux/amd64 and Windows/amd64 cross-builds — passed.
• git diff --check — passed.

No application regression test is added for a Go standard-library/toolchain fix. Existing full-suite and cross-platform build checks exercise compatibility. Docker could not be built locally because no Docker executable is installed; image build remains unverified.

Contribution disclosure

AI-assisted implementation and verification by Hermes at the owner's request. Opened as a draft pending human review, as requested by CONTRIBUTING.md. Upstream CI status should be evaluated on this PR's exact head, not inferred from local results.

[bwappsec]

⚠️ Snyk checks are incomplete.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details
⚠️	Licenses	0	0	0	0	See details
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[brianluisgomez]

/snyk_check

[joshraub-bw]

/check

[joshraub-bw]

/snyk_check

[nolanpeters2]

/snyk_check

[nolanpeters2]

AppSec is force passing the failing security and license Snyk checks due to a backend error. This PR is upgrading versions.