[qa-admin-marko-grgic-gh]

Context

On 2026-10-20 the compromise of the private keys of eight eMudhra intermediate CAs was disclosed (https://emudhra.we-have-a-problem.com). The affected roots are "AAA Certificate Services" (Comodo) and "emSign ECC Root CA - G3". Go 1.27.3 and 1.26.10 ship the matching fix.

What changed

• release/versions.txt: go 1.27.1 -> go 1.27.3

src/go.mod keeps its minimum go 1.25.3, as before.

Why

versions.txt only records the versions that the monthly check-manual-dependencies workflow compares against. The release workflow itself looks up the latest Go tag through release/0-get-latest-dependencies-versions.sh at release time. Today that lookup returns go1.27.3 (checked with the repo's own script), so the next release builds with the fixed Go. This PR brings the committed state up to date, so the change is visible and the next release can be tied to it.

Goreleaser v2.18.3 is also available. It is unrelated to this fix and was left for the regular AutoUpdate.

Verification

• go1.27.3 exists as a tag in golang/go and is listed on go.dev/dl.
• Ran release/101-save-latest-versions.sh with OUT=release/new.versions.txt: it resolves go 1.27.3.
• With Go 1.27.3 in src/: go build ./..., go vet ./... and go test ./... pass (the package has no test files).

Post-merge

• Cut a new release (Release workflow). This builds the binaries with Go 1.27.3 and republishes qaware/protocurl on Docker Hub. The rebuilt image also gets the current gcr.io/distroless/cc:latest and debian:12-slim layers, which include the Debian ca-certificates fix (20250419~deb12u2).

Follow-ups

• The test servers under test/servers run on Node.js. Node has no fixed release yet, so nothing changed there.

[GollyTicker]

Thank you. I had updated the existing dependencies update PR, but that one was beofre the compromise.

[GollyTicker]

✅ CA compromise is fixed in the newest version https://github.com/qaware/protocurl/releases/tag/v1.20.6 ✅