Bump Go to 1.27.3 to fix certificate trust vulnerability

Merged
RO
3d ago
+3-3

Summary

  • Bump the main and smoke-test module toolchains, plus the mise Go pin, from 1.27.2 to 1.27.3.
  • Fix GO-2026-6809 (CVE-2026-111943): distrust compromised intermediate certificates in crypto/x509.
  • Leave the minimum Go versions and dependencies unchanged. A rebuilt release is required to fix existing installations; this PR does not publish one.

Verification

  • Negative control: govulncheck under Go 1.27.2 reports GO-2026-6809 with a call trace through the attachment downloader to x509.Certificate.Verify.
  • govulncheck under Go 1.27.3 reports zero vulnerabilities affecting the CLI. Both scans also report one module-level vulnerability not called by this code.
  • make test under Go 1.27.3: all 19 unit-test packages pass.
  • make build succeeds; go version -m confirms the binary uses Go 1.27.3.
  • Smoke-test module compiles with Go 1.27.3. Live smoke tests were not run (require a HEY dev server).
  • git diff --check passes.

Summary by cubic

Bumps the Go toolchain in the main and smoke-test modules, plus the mise pin, from 1.27.2 to 1.27.3 to fix GO-2026-6809 (CVE-2026-111943), which distrusts compromised intermediate certificates in crypto/x509.

The minimum Go version and dependencies are unchanged. A rebuilt release is required to fix existing installations; this PR does not publish one.