From 132fcd320dd9b59985e8de62ac589762d2a76564 Mon Sep 17 00:00:00 2001 From: Olivia Haven Date: Tue, 20 Oct 2026 16:59:39 +0000 Subject: [PATCH] OPS-3794: upgrade Go to 1.27.3 Go 1.27.3 is a security release for CVE-2026-111943: crypto/x509 Verify now filters out chains through a small set of distrusted intermediate CAs. c1i is an app (a CLI shipped as signed release binaries, with no importable packages), so the go.mod `go` directive moves from 1.27.2 to 1.27.3. CI and release use `go-version-file: go.mod` (and `GOTOOLCHAIN: auto` for the scanners) and follow it. References: - Go issue: https://go.dev/issue/82345 - Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ - Tracking: https://linear.app/ductone/issue/OPS-3794 Co-Authored-By: Claude Opus 5.5 Co-authored-by: c1-squire-dev[bot] Signed-off-by: Olivia Haven --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index c2bcd70..e21fb86 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/ConductorOne/c1i -go 1.27.2 +go 1.27.3 require ( github.com/go-jose/go-jose/v4 v4.1.5