[pilat]

Describe your changes

The module's Go 1.26.8 toolchain is affected by CVE-2026-111943 in crypto/x509.Certificate.Verify. The minimum is now Go 1.27.3, which includes the upstream fix, and the Go module graph is refreshed. E2E initialization also uses a temporary HOME so read-only runner homes do not fail.

Verification

• go version (Go 1.27.3)
• go mod tidy -diff
• go test -gcflags=all=-l ./cmd/... ./internal/...
• go build -o "$TMP/bin/devbox" ./cmd/devbox/
• go test -gcflags=all=-l ./tests/e2e -run '^TestE2ESuite$/^Test10_ProjectInitialization$' -count=1
• Full E2E suite not run locally because Docker CLI is unavailable.

Type of change

Bug fix

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: pilat/devbox
• Branch: fix/e2e-home-isolation
• File: .coderabbit.yaml
• Commit: 0c5f461
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1c4ddd7b-839e-4d41-806f-f13d2a674cb6

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}