From 7c73bcc0c7045ece57948da1581d239cc6b33954 Mon Sep 17 00:00:00 2001 From: kyle-livekit Date: Tue, 20 Oct 2026 13:37:00 -0700 Subject: [PATCH] fix: build with Go 1.27.3 (eMudhra intermediate CA compromise) (#5034) Go 1.27.3 includes crypto/x509 security fixes for the compromised eMudhra intermediates. See https://emudhra.we-have-a-problem.com/. Co-authored-by: Claude Opus 5.5 --- Dockerfile | 2 +- cmd/test-server/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4d9920a2f..7d90219e2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,7 +17,7 @@ # This image is also the single source of truth for the Go toolchain: CI reads the # version out of this line (see .github/scripts/go-version.sh) so tests and images # always run the same runtime. -FROM golang:1.27.1-alpine3.24@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS builder +FROM golang:1.27.3-alpine3.24@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd AS builder ARG TARGETPLATFORM ARG TARGETARCH diff --git a/cmd/test-server/Dockerfile b/cmd/test-server/Dockerfile index bbac501ec..a77142b5c 100644 --- a/cmd/test-server/Dockerfile +++ b/cmd/test-server/Dockerfile @@ -17,7 +17,7 @@ # # Pinned by digest so the build is reproducible even if the tag is republished. # The tag is kept alongside it for readability; Renovate updates both together. -FROM golang:1.27.1-alpine3.24@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS builder +FROM golang:1.27.3-alpine3.24@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd AS builder ARG TARGETARCH