[tnsardesai]

Summary

Go 1.25 and older are out of support now that Go 1.27 has shipped. This moves the repo to the latest patch release, Go 1.27.3, which includes the crypto/x509 fix for CVE-2026-111943 (Go stops trusting certificate chains through the compromised eMudhra intermediates).

module	before	after
go.mod	go 1.25.8	go 1.27.3

Other places that pin the Go toolchain:

• CI, acceptance and release workflows read go-version-file: go.mod

Breaking changes and GODEBUG review

Raising the go line changes these defaults (none are overridden in this repo, via godebug blocks, //go:debug or GODEBUG env):

• Go 1.26: urlstrictcolons=1 (url.Parse rejects extra colons in the host), cryptocustomrand=0 (crypto ignores caller-supplied rand readers), tlssecpmlkem=1 (SecP256r1MLKEM768/SecP384r1MLKEM1024 on by default)
• Go 1.27: tracebacklabels=1 (pprof goroutine labels are printed in tracebacks)

Removed outright in 1.27 (new behavior regardless of the go line): asynctimerchan, gotypesalias, tls10server, tlsrsakex, tls3des, tlsunsafeekm, x509keypairleaf. None are set here.

Toolchain changes that apply as soon as 1.27 builds the code: encoding/json runs on the v2 implementation (same behavior, different error text), HTTP/1 Response.Body.Close drains unread bodies, ServeMux trailing-slash redirects are 307 (1.26), Green Tea GC is on (1.26), go test runs the stdversion vet check, and gofmt alignment changed slightly.

Verification

• go build ./... pass, go vet ./... pass, go test -short ./... 12 ok / 0 failed on 1.27.3 (baseline on go1.25.8: 12 ok / 0 failed)

Notes

• Release binaries come from the go.mod version, so the next provider release is built with 1.27.3. Acceptance tests against Kernel were not run locally.

---

Note

Medium Risk
A major Go jump can change HTTP/TLS, URL parsing, and JSON error text at runtime even with no application diff; tests passed locally but acceptance against Kernel was not re-run.

Overview
Bumps the module go directive from 1.25.8 to 1.27.3 so builds and tests use a supported toolchain, including the crypto/x509 fix for CVE-2026-111943.

CI (ci, acceptance, release) already reads go-version-file: go.mod, so workflows and release binaries follow this version without further repo changes. No provider code or dependency pins change in the diff—only the toolchain line—so behavior shifts come from Go 1.26/1.27 defaults (e.g. stricter URL parsing, TLS defaults, JSON encoder implementation) rather from edits in this repo.

^{Reviewed by Cursor Bugbot for commit 1021774. Bugbot is set up for automated code reviews on this repo. Configure here.}

[tnsardesai]

Picked sjmiller609 to review: recent commits in go.mod; 2 pending