From fa0a15b8a683f9c05184380f3d5a5effba5dc045 Mon Sep 17 00:00:00 2001 From: shusingh Date: Thu, 29 Oct 2026 14:34:41 +0530 Subject: [PATCH] security: bump Go toolchain to 1.27.3 (eMudhra CA distrust) Bumps the Go toolchain from go1.27.2 to go1.27.3 to pick up the crypto/x509 fix that distrusts compromised eMudhra intermediate certificates. Fixes GO-2026-6809 (CVE-2026-111943), the only code-reachable vulnerability reported by govulncheck against dev-v2. Verified with govulncheck: 'Your code is affected by 0 vulnerabilities.' Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- go.mod | 2 +- sdk/go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 75a5fe291..a5f7691d8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,7 +39,7 @@ jobs: uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0 with: version: "${{ env.GOLANGCI_LINT_VERSION }}" - # goinstall builds golangci-lint with the repo's go toolchain (go1.27.2) since the + # goinstall builds golangci-lint with the repo's go toolchain (go1.27.3) since the # official binary release is built with an older Go and can't read go1.27 export data. install-mode: goinstall args: -c ./scripts/.golangci.yml diff --git a/go.mod b/go.mod index 826ea9a84..79f5e4bd5 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/nginx/agent/v2 go 1.26.0 -toolchain go1.27.2 +toolchain go1.27.3 require ( github.com/cenkalti/backoff/v4 v4.3.0 // indirect diff --git a/sdk/go.mod b/sdk/go.mod index b28a4ec48..deffc51e7 100644 --- a/sdk/go.mod +++ b/sdk/go.mod @@ -2,7 +2,7 @@ module github.com/nginx/agent/sdk/v2 go 1.26.0 -toolchain go1.27.2 +toolchain go1.27.3 require ( github.com/cenkalti/backoff/v4 v4.3.0