[icco]

Why

Response to the eMudhra intermediate CA compromise: https://emudhra.we-have-a-problem.com/

• Bump Go to 1.27.3 and upgrade ca-certificates to 20250419+deb13u1 (DSA-6572-1).
• Set NODE_OPTIONS=--use-openssl-ca since no Node release drops the bad intermediates yet (tls: reject chains containing blocked public keys nodejs/node#66871).

Risks

Node now trusts the system CA store instead of its bundled one, so any CA missing from Debian's store will fail TLS in Node processes.

[Copilot]

🔵 Needs a closer look

Build-time dependency downloads lack the trust-store mitigation, and rejection of compromised chains in the resulting image remains unverified.

1 open issue

• Apply trust-store settings before dependency downloads · New

What changed in this PR

Updates the container's TLS dependencies and Node trust settings in response to the eMudhra intermediate CA compromise.

Changes:

• Bumps Go to 1.27.3.
• Explicitly upgrades Debian's ca-certificates package.
• Configures runtime Node processes to use the system CA store.

File	Description
Dockerfile	Updates Go, CA certificates, and Node trust-store settings.

_{Review effort: Balanced}