From bfa2418c115746b5f34d71b6c6e8877efa5c1a40 Mon Sep 17 00:00:00 2001 From: James Nesbitt Date: Thu, 22 Oct 2026 16:38:55 +0300 Subject: [PATCH] chore: require go 1.27.3 for GO-2026-6809 govulncheck fails Security Scan on main and every branch cut from it: Vulnerability #1: GO-2026-6809 Distrust compromised intermediate certificates in crypto/x509 Found in: crypto/x509@go1.27.2 Fixed in: crypto/x509@go1.27.3 #1: pkg/configurer/linux.go:424:14: configurer.LinuxConfigurer.UpdateEnvironment calls fmt.Fprintf, which eventually calls x509.Certificate.Verify The go directive is the only pin: every workflow resolves its toolchain with actions/setup-go go-version-file: go.mod (build.yml, go.yml, pr.yml, release.yml), so bumping it to 1.27.3 moves CI onto the fixed stdlib. No source change is required - the finding is in the standard library, not in launchpad code or a required module. Verified with go1.27.3 locally: go build ./... and go test --tags testing ./pkg/... both pass. govulncheck is not installed on this workstation, so the scan itself was not re-run locally; CI Security Scan is the check that confirms it. Written by AI: claude-opus-5 Signed-off-by: James Nesbitt --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 140e03dd..59b380b4 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/Mirantis/launchpad -go 1.27.2 +go 1.27.3 require ( github.com/AlecAivazis/survey/v2 v2.3.7