Repository navigation
build: upgrade Go toolchain to 1.27.3 - #2654
Merged
Merged
Conversation
In this commit, we upgrade CI, Docker builds and release binaries to Go 1.27.3. This release adds the crypto/x509 mitigation for CVE-2026-111943, which distrusts affected intermediate CA keys. We also move every module language version to Go 1.26.10, the latest release on the previous supported branch.
In this commit, we spell out the patched Go point-release floor for each supported branch. The go directive can require a minimum version, but it cannot prevent builds with Go 1.27.0 through 1.27.2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In this PR, we upgrade CI, Docker builds and release binaries to Go 1.27.3. The release adds the
crypto/x509mitigation for CVE-2026-111943, which rejects certificate chains containing affected intermediate CA keys. We also move every module'sgodirective to Go 1.26.10, the latest release on the previous supported branch, and update the documented minimum and release instructions.The
godirective expresses only a minimum version, so it cannot encode the patched floor on both supported branches. Use Go 1.26.10 or newer on the Go 1.26 branch, and Go 1.27.3 or newer on the Go 1.27 branch; Go 1.27.0 through 1.27.2 do not include this mitigation. The release script continues to require Go 1.27.3 for release builds.Both Docker build images use the verified
golang:1.27.3-alpine3.24index digest,sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd.Validation:
make check-go-versionsmake buildmake unitgo test ./...in all nine nested modulesgit diff --checkAll checks ran with Go 1.27.3 on darwin/arm64.