From 10c0cb55938d9066784c43560860109d2199ade0 Mon Sep 17 00:00:00 2001 From: binwiederhier Date: Thu, 22 Oct 2026 01:18:09 +0000 Subject: [PATCH] Build with Go 1.27.3 Go 1.27.2 and 1.27.3 are security releases; 1.27.3 makes crypto/x509 reject chains through the eight compromised eMudhra intermediate CAs. ntfy's outbound TLS (Firebase, web push, Stripe, Twilio, S3, upstream) only gets that by being rebuilt. The bump was held at 1.27.1 because staticcheck v0.8.1 could not read Go 1.27.2's export data; staticcheck 2026.2.2 (v0.8.2) can, and is clean. text/template is unchanged, so only GENERATED_FROM moves. --- .go-version | 2 +- docs/releases.md | 1 + template/gotext/GENERATED_FROM | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.go-version b/.go-version index 08002f86..3bae5204 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.27.1 +1.27.3 diff --git a/docs/releases.md b/docs/releases.md index cb8aed0f..3b1dade1 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -2219,6 +2219,7 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release **Security:** +* Build with Go 1.27.3, which includes the security fixes of Go 1.27.2 (`crypto/tls`, `net/http`, `html/template` and others) and 1.27.3 (`crypto/x509`: certificate chains through the compromised eMudhra intermediate CAs are rejected) * Reject phone number verification unless Twilio confirms the code as approved, instead of accepting any successful response * Ignore duplicate topics in a subscription and limit a subscription to 150 topics, so a single request cannot replay the same topic's cache over and over diff --git a/template/gotext/GENERATED_FROM b/template/gotext/GENERATED_FROM index ae6d67be..248b50f6 100644 --- a/template/gotext/GENERATED_FROM +++ b/template/gotext/GENERATED_FROM @@ -1 +1 @@ -go1.27.1 +go1.27.3