[om986]

Summary

• Bump Go from 1.27.2 to 1.27.3 in CI, CodeQL, release, go.mod, and the builder image.
• Go 1.27.2 is affected by GO-2026-6809 (crypto/x509 still trusts a set of intermediate certificates). That is reachable from internal/auth/mail.go and is what failed the govulncheck job.
• A local govulncheck ./... on Go 1.27.3 reports no vulnerabilities in code that is called.

Test plan

• Confirm the govulncheck CI job passes on this pull request
• Confirm the go CI job still builds and tests

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: OpenSourceOM/core
• Branch: fix/go-1.27.3
• File: .coderabbit.yaml
• Commit: bcb24ce
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: ee0a7b07-e5a0-4cb1-9ab0-45df61102fd9

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}