From f8fd837003cfe94d29798ce124da079da5aa1f93 Mon Sep 17 00:00:00 2001 From: kycheng Date: Fri, 23 Oct 2026 06:30:28 +0800 Subject: [PATCH] build: bump go directive to 1.27.3 (CVE-2026-111943) actions/setup-go reads the go directive's patch version from go-version-file: go.mod and ignores the toolchain line, so it kept installing 1.27.2 and building kubectl with the unpatched crypto/x509 stdlib. Bump the go directive itself so setup-go installs 1.27.3. Co-Authored-By: Claude Opus 4.8 --- go.mod | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 194a822dbb94d..30b8e62f6e3fb 100644 --- a/go.mod +++ b/go.mod @@ -6,8 +6,7 @@ module k8s.io/kubernetes -go 1.27.2 -toolchain go1.27.3 +go 1.27.3 godebug default=go1.26