[jamengual]

what

Backport of #6999 to release-0.48, so v0.48.2 can be cut from this branch with only the security fix plus image refreshes. No feature commits from main.

• Go 1.27.1 → 1.27.3 in go.mod, e2e/go.mod, .github/scripts/update_top_issues_ranking/go.mod, the Dockerfile builder (golang:1.27.3-alpine3.24@sha256:f2c872bc…) and testing/Dockerfile (golang:1.27.3@sha256:95786118…).
• Dockerfile and testing/Dockerfile are taken from main (the cherry-pick conflicted only on the release branch's older 1.27.1 digests). That also brings the image refreshes main already has since v0.48.1:
  • Debian curl 8.14.1-2+deb13u7 / openssl 3.5.7-1~deb13u3 (fix(docker): bump debian curl and openssl pins to trixie-security versions #6990). Required: the deb13u5/deb13u2 pins on this branch were removed from Debian, so the Debian image can't build from release-0.48 as it stands.
  • Alpine 3.24.2 (chore(deps): update alpine docker tag to v3.24.2 in dockerfile (main) #6931), conftest 0.70.1 (chore(deps): update dependency open-policy-agent/conftest to v0.70.1 in dockerfile (main) #6950), Terraform 1.16.5 (chore(deps): update dependency hashicorp/terraform to v1.16.4 in testdrive/utils.go (main) #6946, chore(deps): update dependency hashicorp/terraform to v1.16.5 in testdrive/utils.go (main) #6967), dockerfile frontend digest (chore(deps): update docker/dockerfile:1 docker digest to 4edf897 in dockerfile (main) #6954).

why

The private keys of eight eMudhra intermediate CA certificates were compromised. go1.27.3 adds a built-in distrust of those keys to crypto/x509 (CVE-2026-111943), and v0.48.1 is built with go1.27.1. See #6999 for the full analysis and references.

ca-certificates (second commit)

Alpine and Debian shipped ca-certificates security updates for this incident on 2026-10-20:

• Alpine 20261020-r0 drops emSign ECC Root CA - G3 (plus eMudhra's planned removal of emSign Root CA - C1 / emSign ECC Root CA - C3). I compared the old and new bundles: 121 → 118 certificates. Alpine also removed 20260909-r0 from the 3.24 index, so every Alpine image build fails until the pin moves. That's why fix: bound UnlockByPull repo scan and scan all Redis Cluster masters #6736's image builds are now red.
• Debian 20250419+deb13u1 (trixie-security, #1151413) blacklists emSign ECC Root CA - G3 and the Comodo AAA Services root, which cross-signed some of the compromised intermediates.

This covers the non-Go TLS clients in the image (git, curl, and terraform/tofu/conftest through the system store), which the Go 1.27.3 distrust doesn't reach. Note: at the time of writing, Alpine's armv7 index still serves 20260909-r0, so the linux/arm/v7 Alpine build can fail until Alpine's armv7 builder catches up.

golangci-lint (third commit)

go-lint.yml: golangci-lint v2.13.2 → v2.15.0. v2.13.2 can't read the export data go1.27.3 writes and fails every package with typecheck errors (export data version 5 is greater than maximum supported version 4). I ran both versions against this tree in a golang:1.27.3 container: v2.13.2 reproduces the CI errors, and v2.15.0 reports 0 issues.

release

After merge: gh release create v0.48.2 --target release-0.48 --latest, with a Highlights section covering the Go/x509 fix and the runtime image refresh.

🤖 Generated with Claude Code