From 0c8e3f39cb81f1040620d96400f7150d503d2cef Mon Sep 17 00:00:00 2001 From: kush shah Date: Wed, 21 Oct 2026 01:21:49 -0400 Subject: [PATCH] fix: require Go 1.27.3 for eMudhra certificate mitigation --- CONTRIBUTING.md | 8 +++++++- Dockerfile | 2 +- go.mod | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1f84668..a6bb951 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -12,7 +12,13 @@ make test # run tests make lint # run golangci-lint ``` -Requires Go 1.22+ and [golangci-lint](https://golangci-lint.run/welcome/install/). +Requires Go 1.27.3+ and [golangci-lint](https://golangci-lint.run/welcome/install/). + +Go 1.27.3 includes the `crypto/x509` fix rejecting the compromised eMudhra +intermediate certificates. CI and release builds select the toolchain from +`go.mod`; keep the Docker builder's version aligned with that minimum. Existing +CLI binaries and container images must be rebuilt to pick up the fix; updating +the host's Go installation does not patch an already compiled binary. ## What happens when you open a PR diff --git a/Dockerfile b/Dockerfile index 1ae92b1..4f9cf99 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.27.3-alpine AS builder WORKDIR /app COPY go.mod go.sum ./ RUN go mod download diff --git a/go.mod b/go.mod index 98f3f50..755af6b 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/Bandwidth/cli -go 1.26.6 +go 1.27.3 require ( github.com/briandowns/spinner v1.23.2