[juilichormole]

Summary

Go 1.27.3 and 1.26.10 (released 2026-10-20) make the certificate verifier reject chains through eight leaked eMudhra intermediate CA keys (CVE-2026-111943, Wiz wiz-adv-2026-187). Go compiles that check into each binary, so a service keeps the old trust behavior until its image is rebuilt on a patched toolchain. There is no known exploitation, and none of our endpoints use eMudhra certificates, so nothing should change at runtime.

This moves the go-builder stage from golang:1.27.2 to golang:1.27.3.

Changes

• Dockerfile: FROM golang:1.27.2 AS go-builder → FROM golang:1.27.3 AS go-builder

go.mod stays at go 1.25.0; that's the minimum version, not the build toolchain.

Test plan

• Image build passes in CI and the binary reports go1.27.3 (go version -m)
• Deploy and confirm the service starts healthy

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The target image and claimed security fix remain unverified, and image-build and startup checks are still pending.

No open issues 🎉

What changed in this PR

Updates the Docker build toolchain to pick up the certificate-verification security fix described in the PR.

Changes:

• Bumps the go-builder image from golang:1.27.2 to golang:1.27.3.
• Leaves the minimum Go version in go.mod unchanged.

File	Description
Dockerfile	Updates the Go builder image to version 1.27.3.

_{Review effort: Balanced}