[gerardrecinto]

govulncheck and the Trivy image scan now fail on master with GO-2026-6809 in crypto/x509, found in go1.26.9 and fixed in go1.26.10. This moves every go.mod and go.work to 1.26.10, the Docker base images to golang:1.27.3 (bindings build image to 1.26.10), and the version mentions in the README and docs. Historical mentions in docs/INCIDENTS.md and the example lab notes are left as written.

[github-actions]

Gemini PR Review

Reviewed commit: 31247f4a72be0d655cbb3d454545e457339cc74d
Verdict: PASS

This pull request updates the Go toolchain version across the codebase, Dockerfiles, and documentation from 1.26.9 to 1.26.10 and 1.27.2 to 1.27.3. The CHANGELOG.md indicates this is done for CVE remediation (GO-2026-6809 in crypto/x509). This is a security-motivated change to upgrade dependencies to versions containing known fixes.

No actionable findings were identified:

• Security problems: The changes are designed to mitigate a known security vulnerability in the Go standard library, not introduce new ones. There are no code changes that could lead to new injection, deserialization, path handling, secret exposure, or authorization issues.
• Correctness bugs, races, leaks, and unhandled edge cases: The changes consist of version number updates in go.mod files, Dockerfiles, and documentation. There are no functional code changes that could introduce new correctness bugs, data races, memory leaks, or unhandled edge cases. Go patch and minor version updates are generally backward-compatible.
• Missing or weakened tests: The pull request does not alter any test files or testing logic. The existing test suite is expected to run against the new Go versions, implicitly verifying compatibility.