[nodo]

Problem

govulncheck now fails on every branch: GO-2026-6809 (crypto/x509 distrusts compromised intermediate certificates) was published after main's last green scan. It is found in go1.27.2 and fixed in go1.27.3, and git-sync calls it through TLS verification on HTTPS remotes (syncer.countingReadCloser.Read → x509.Certificate.Verify).

Changes

• go.mod toolchain and the mise pin: 1.27.2 → 1.27.3.
• CHANGELOG entry under Security.

The go directive stays at 1.26, so the minimum Go version for library consumers is unchanged.

Tests

On go1.27.3: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./... (as CI runs it) reports no called vulnerabilities; the remaining uncalled module finding is the known GO-2026-5932. go test ./... and golangci-lint run pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_015oS6W9qjGMVnrTz5r8EwDL

---

Note

Low Risk
Toolchain and changelog-only change with no application logic; it reduces TLS-related exposure in released binaries.

Overview
Bumps the Go toolchain from 1.27.2 to 1.27.3 in go.mod and the mise pin so CI and local builds use the patched standard library.

Documents the change under Security in CHANGELOG.md, noting it clears GO-2026-6809 (crypto/x509 distrust of compromised intermediate CAs), which affects TLS verification on HTTPS remotes. The module go directive stays at 1.26, so the minimum Go version for library consumers is unchanged.

^{Reviewed by Cursor Bugbot for commit c29038b. Configure here.}

[Copilot]

🟢 Approval recommended

The narrowly scoped toolchain pins remain aligned, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

Updates git-sync’s Go toolchain to address GO-2026-6809 without changing the minimum Go version for library consumers.

Changes:

• Aligns both toolchain pins at Go 1.27.3.
• Documents the security update in the changelog.

File	Description
mise.toml	Updates the development Go pin to 1.27.3.
go.mod	Updates the toolchain to 1.27.3; retains Go 1.26 minimum.
CHANGELOG.md	Records the certificate-verification security update.

_{Review effort: Balanced}