Repository navigation
OPS-3794: upgrade Go to 1.27.3 - #154
Merged
Merged
Conversation
Go 1.27.3 is a security release for CVE-2026-111943: crypto/x509 Verify now filters out chains through a small set of distrusted intermediate CAs. c1i is an app (a CLI shipped as signed release binaries, with no importable packages), so the go.mod `go` directive moves from 1.27.2 to 1.27.3. CI and release use `go-version-file: go.mod` (and `GOTOOLCHAIN: auto` for the scanners) and follow it. References: - Go issue: https://go.dev/issue/82345 - Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ - Tracking: https://linear.app/ductone/issue/OPS-3794 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Signed-off-by: Olivia Haven <olivia.haven@conductorone.com>
olivia-c1
marked this pull request as ready for review
October 20, 2026 17:13
olivia-c1
requested review from
arreyder,
dstokes,
ennyjfrick,
jemisonf and
tthayer
October 20, 2026 17:13
tthayer
approved these changes
Oct 20, 2026
tthayer
left a comment
tthayer
left a comment
There was a problem hiding this comment.
One-line go directive bump (1.27.2 to 1.27.3) for the CVE-2026-111943 x509 fix; module path and require block untouched, CI green including the lint/scanner jobs. Nothing to flag.
Two notes: the base-drift check was skipped because there is no local clone of ConductorOne/c1i, so only the mainline comparison is missing. And the ticket's real completion criteria are the post-merge steps you list: cut v0.9.2 on the merge commit and confirm go version -m reports go1.27.3.
dstokes
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Go 1.27.3 is a security release for CVE-2026-111943: crypto/x509 Verify now filters out chains through a small set of distrusted intermediate CAs. c1i is an app (a CLI shipped as signed release binaries, with no importable packages), so the go.mod
godirective moves from 1.27.2 to 1.27.3. CI and release usego-version-file: go.mod(andGOTOOLCHAIN: autofor the scanners) and follow it.References:
Files changed
go.modValidation
GOTOOLCHAIN=go1.27.3 go mod tidy,go build ./...,go vet ./...,go test -short ./...pass.Left for CI
Full CI (golangci-lint, gosec, govulncheck per GOOS, gitleaks, shuffled tests).
Rollout / follow-up (manual steps at merge)
v0.9.2on the merge commit of main (manual)..github/workflows/release.yamltriggers on any tag and callsConductorOne/github-workflows/.github/workflows/release.yaml@v4(docker: true,msi: true), which builds with Go from the taggedgo.mod(1.27.3) (auto: release workflow).go version -m <binary>) (manual check).🤖 Generated with Claude Code