Repository navigation
Mirrors baseline v4.8.2, Go 1.27.3 as the floor, pinning baseline commit c79c209.
The pin moves to Go 1.27.3. It fixes GO-2026-6809 in crypto/x509. Under 1.27.2, govulncheck reports it as called from cmd/server, so ./verify.sh stops at its fifth step. verify.sh names the new pin; go.mod already says go 1.27, so nothing in the build moves.
The dependencies moved under it, as the baseline's operations/ci.md asks when VERSIONS.md moves: golang.org/x/crypto v0.58.0, x/sync v0.24.0 and x/time v0.16.0, plus go-humanize, go-strftime and x/sys. modernc.org/sqlite stays at the pinned v1.58.0, and modernc.org/libc goes back from v1.75.7 to v1.75.6, the exact version that driver's go.mod names.
./verify.sh exits 0 over 79 gates and make ci is green on this commit, both under Go 1.27.3.