[tnsardesai]

Summary

Moves the repo from Go 1.27.2 to Go 1.27.3.

Go 1.27.3 is a security release with one fix: crypto/x509 stops trusting certificate chains through eight eMudhra intermediates whose private keys were compromised (CVE-2026-111943). Binaries built with go1.27.2 accept those chains whenever the CA bundle they run with predates the 2026-10-20 trust-store updates. There are no API or GODEBUG changes between 1.27.2 and 1.27.3.

main has been on Go 1.27 since 2026-10-15, but the latest release, v0.18.0 (2026-08-12), was built with go1.25.12, which is out of support. Cut a release after merging.

Changes

• go.mod: go 1.27.2 -> go 1.27.3; CI and GoReleaser read the version from go.mod

go mod tidy changed nothing else.

Verification

• go build ./..., go vet ./... and go test -short ./...: 3/3 packages pass on unmodified go1.27.3, the same as main on go1.27.2.

---

Note

Low Risk
Single-line toolchain bump with no dependency or application code changes; main effect is inheriting Go 1.27.3’s security fix at build time.

Overview
Bumps the module’s Go toolchain from 1.27.2 to 1.27.3 in go.mod. CI (ci.yml, publish-release, vuln remediation) and release tooling already use go-version-file: go.mod, so they pick up 1.27.3 with no other file changes.

This is a patch-level security release (notably CVE-2026-111943 / crypto/x509 trust for compromised eMudhra intermediates). Dependencies and go.sum are unchanged; behavior of this repo’s code should stay the same aside from stricter TLS cert validation in binaries built with the new toolchain.

^{Reviewed by Cursor Bugbot for commit b14aae4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Sayan-]

yeet