From 29baaac0f34864d511c4fdbaa64249d7b0b64cfd Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Wed, 21 Oct 2026 17:05:40 -0300 Subject: [PATCH] build: Go 1.27.3, which distrusts the compromised intermediates Eight of eMudhra's intermediate CA keys were weak enough to recover (CVE-2026-111943). Go 1.27.3 refuses a chain through any of them, by key. Pinned as the toolchain: with `go 1.27` alone a build here resolved to 1.27.0, the series' first. Co-Authored-By: Claude Fable 5.1 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index aaf4645..15142c3 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/spin-stack/go-tools go 1.27 -toolchain go1.27.2 +toolchain go1.27.3 require ( github.com/CycloneDX/cyclonedx-go v0.12.0