From 38f06f88fc8638265ed89d174f86728f17b9fc2a Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Tue, 27 Oct 2026 20:16:08 -0400 Subject: [PATCH] fix(build): raise the Go floor to 1.27.3 for GO-2026-6809 (crypto/x509) Release archives were compiled by go1.27.1 (goreleaser-cross:v1.27.1-1), which carries GO-2026-6809 in crypto/x509, fixed in go1.27.3. The go directive is a floor: goreleaser-cross sets no GOTOOLCHAIN, so the image's go auto-switches up to the directive when the directive is higher. Raising go.mod to 1.27.3 is the fix that ships; moving the image pin to goreleaser-cross:v1.27.3 is the belt to that brace. No toolchain line, no GOTOOLCHAIN pin. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8b84fb9..ca5899b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,7 +36,7 @@ jobs: -v "$GITHUB_WORKSPACE:/workspace" -v "$SYFT_PATH:/usr/local/bin/syft:ro" -w /workspace - ghcr.io/goreleaser/goreleaser-cross:v1.27.1-1 + ghcr.io/goreleaser/goreleaser-cross:v1.27.3 release --clean env: GITHUB_TOKEN: ${{ secrets.GH_PAT }} diff --git a/go.mod b/go.mod index 91f1cff..db16235 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/codefly-dev/service-rust -go 1.27.0 +go 1.27.3 require ( github.com/codefly-dev/core v0.5.0