[tnsardesai]

Summary

This moves the repo from Go 1.26.10 to the latest patch release, Go 1.27.3. Both include the crypto/x509 fix for CVE-2026-111943 (the compromised eMudhra intermediates).

module	before	after
server/go.mod	go 1.26.10	go 1.27.3

Other places that pin the Go toolchain:

• images/chromium-headless/image/Dockerfile, images/chromium-headful/Dockerfile: docker.io/golang:1.26.10 -> docker.io/golang:1.27.3
• AGENTS.md, server/README.md: required Go version
• CI (server-test, chromium-launcher-test, vuln-remediation) reads go-version-file: server/go.mod

Other changes needed for the upgrade:

• go mod tidy removed 349 stale server/go.sum lines for module versions no longer in the graph.

Breaking changes and GODEBUG review

main is already on Go 1.26.10, so raising the go line only changes the Go 1.27 default: tracebacklabels=1 (pprof goroutine labels are printed in tracebacks). It isn't overridden here (no godebug blocks, //go:debug or GODEBUG env).

Removed outright in 1.27 (new behavior regardless of the go line): asynctimerchan, gotypesalias, tls10server, tlsrsakex, tls3des, tlsunsafeekm, x509keypairleaf. None are set here.

Toolchain changes that apply as soon as 1.27 builds the code: encoding/json runs on the v2 implementation (same behavior, different error text for some errors), HTTP/1 Response.Body.Close drains unread bodies, go test runs the stdversion vet check, and gofmt alignment changed slightly.

Repo-specific findings:

• server/ builds with CGO_ENABLED=0, and golang:1.27.3 is Debian trixie like golang:1.26.10, so the builder base distro does not change.
• cmd/api/api/browser_repl.go rejects unknown request fields by checking strings.HasPrefix(err.Error(), "json: unknown field") on a DisallowUnknownFields decode. On go1.27.3 the message is unchanged (json: unknown field "extra", checked for top-level and nested unknown fields), so the check keeps working.
• Unix-socket clients never compare read errors with == io.EOF, so 1.27 returning a bare io.EOF from UnixConn reads changes nothing.
• The neko server module is replaced by github.com/kernel/neko/server; the neko base image used by the headful image is built from that repo and is upgraded separately.

Verification

• kernel-images/server: go build ./... pass, go vet ./... pass. Unit tests per AGENTS.md (go test -race, excluding e2e): 32/32 packages ok on go1.27.3 (baseline on main with go1.26.10: 32/32).
• lib/devtoolsproxy's TestUpstreamManagerDetectsChromiumAndRestart launches a real Chromium and is flaky under load on both toolchains. Run on its own, 3 rounds each, it passed 3/3 on this branch and 2/3 on main. Each run also leaves Chromium processes behind, which predates this change.
• Built the server-builder stage of the headless Dockerfile on golang:1.27.3.
• Not run: server/e2e, which needs prebuilt onkernel/chromium-*-test images. Build the images and run e2e before merging.

---

Note

Medium Risk
A full-toolchain bump affects every server binary and image build; Go 1.27 default/runtime behavior changes warrant regression testing beyond unit tests (e2e/image builds were not run in the PR).

Overview
This PR bumps the server module and build toolchain from Go 1.26.10 to Go 1.27.3 (including the crypto/x509 fix for CVE-2026-111943 noted in the PR description).

server/go.mod sets go 1.27.3; go mod tidy shrinks server/go.sum by dropping checksums for modules no longer in the dependency graph. Docs (AGENTS.md, server/README.md) now state the required Go version.

Both Chromium image Dockerfiles use docker.io/golang:1.27.3 for the server-builder stage, so CI workflows that read go-version-file: server/go.mod will pick up 1.27.3 on the next run. No application source changes are in the diff—only toolchain pins and the lockfile cleanup.

^{Reviewed by Cursor Bugbot for commit 09ca0d1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tnsardesai]

Picked sjmiller609 to review: touched the changed code in server; 2 pending