[tnsardesai]

Summary

Moves the repo from Go 1.27.2 to Go 1.27.3.

Go 1.27.3 is a security release with one fix: crypto/x509 stops trusting certificate chains through eight eMudhra intermediates whose private keys were compromised (CVE-2026-111943). Binaries built with go1.27.2 accept those chains whenever the CA bundle they run with predates the 2026-10-20 trust-store updates. There are no API or GODEBUG changes between 1.27.2 and 1.27.3.

The latest release, v0.50.0 (2026-10-26), was built with go1.27.2 and runs on customer machines with their API keys. Cut a release after merging so users get a 1.27.3 build.

Changes

• go.mod: go 1.27.2 -> go 1.27.3; the release workflow reads go-version-file: go.mod
• AGENTS.md: required Go version

go mod tidy changed nothing else.

Verification

• go build ./..., go vet ./... and go test -short ./...: 9/9 packages pass on unmodified go1.27.3, the same as main on go1.27.2.
• gofmt -l reports the same files on main with go1.27.2 as with go1.27.3, so this change adds no formatting drift.

---

Note

Low Risk
Toolchain-only bump with no application code or dependency changes; aligns builds with a security patch in the standard library.

Overview
Bumps the required Go toolchain from 1.27.2 to 1.27.3 in go.mod and documents the same in AGENTS.md. CI and release workflows already use go-version-file: go.mod, so they pick up the new version without further edits.

The motivation is Go 1.27.3’s security fix in crypto/x509 (CVE-2026-111943): untrusted eMudhra intermediate chains are no longer accepted. Dependency versions and module contents are unchanged aside from the go directive.

^{Reviewed by Cursor Bugbot for commit ae96787. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Sayan-]

yeet