[gocanto]

Patches the Go toolchain for the eMudhra intermediate CA compromise published on 21 Oct 2026. Scope agreed in the shared security brief for 23 Oct 2026.

Changes

Change	Advisory
go/helper/go.mod: go 1.27.1 → go 1.27.3 (CI reads it through go-version-file)	CVE-2026-111943 (Go x509 denylist)
Dockerfile: ARG GO_VERSION=1.27.1 → 1.27.3, kept in sync with go.mod as the comment requires	CVE-2026-111943
README.md: stated Go version → 1.27.3	—

FROM debian:trixie-slim is a floating tag, so the next image build picks up the refreshed Mozilla CA bundle; no edit needed. Smoke-test fixtures that write go 1.27.1 into temporary modules are left as they are.

Checks

• go build ./..., go vet ./..., gofmt -l . and go test -race ./... in go/helper on Go 1.27.3: pass
• govulncheck ./... in go/helper: no vulnerabilities found
• ./scripts/task.sh test (Rust and Go suites): not run locally, as this host has no Rust toolchain; CI runs it

Follow-ups

• None beyond CI's Rust test, smoke and Docker jobs.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the minimum Go version to 1.27.3 for Docker images and source builds.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: a4475a66-8976-44b5-9369-b27eee0a3757

📥 Commits

Reviewing files that changed from the base of the PR and between 33de9af and 57cf3fe.

📒 Files selected for processing: 3

• Dockerfile
• README.md
• go/helper/go.mod

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Walkthrough

The Go version changes from 1.27.1 to 1.27.3 in the module declaration, Docker build configuration and README source-build instructions.

Changes

Go version update

Layer / File(s)	Summary
Align Go version requirements go/helper/go.mod, Dockerfile, README.md	The module declaration, Docker build argument and README instructions now specify Go 1.27.3.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 57cf3

The version update is consistent across documented build and container paths, with no merge-blocking issue identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the security-driven Go version update for the x509 CA advisory. It matches the main change in the pull request.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}