Update to go1.27.3

This release includes 1 security fix following the security policy:

- crypto/x509: mitigation for security concerns with a specific Certificate Authority

  We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

  Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

  We highly recommend immediately upgrading to this release.

  This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.

release notes: https://go.dev/doc/devel/release#go1.27.3

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

.devcontainer/devcontainer.json

@@ -12,7 +12,7 @@
 	"features": {
 		"ghcr.io/devcontainers/features/docker-in-docker:2": {},
 		"ghcr.io/devcontainers/features/go:1": {
-			"version": "1.27.2"
+			"version": "1.27.3"
 		}
 	},
 

.github/actions/install-go/action.yml

@@ -3,7 +3,7 @@ description: "Reusable action to install Go, so there is one place to bump Go ve
 inputs:
   go-version:
     required: true
-    default: "1.27.2"
+    default: "1.27.3"
     description: "Go version to install"
 
 runs:

.github/workflows/api-release.yml

@@ -6,7 +6,7 @@ on:
 name: API Release
 
 env:
-  GO_VERSION: "1.27.2"
+  GO_VERSION: "1.27.3"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read

.github/workflows/ci.yml

@@ -206,7 +206,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm, macos-latest, windows-latest]
-        go-version: ["1.27.2"] # 1.26 is not supported due to k8s 1.38 requiring 1.27
+        go-version: ["1.27.3"] # 1.26 is not supported due to k8s 1.38 requiring 1.27
         exclude:
           - os: ${{ github.event.repository.private && 'ubuntu-24.04-arm' || '' }}
     steps:

.github/workflows/release/Dockerfile

@@ -14,7 +14,7 @@
 
 ARG UBUNTU_VERSION=22.04
 ARG BASE_IMAGE=ubuntu:${UBUNTU_VERSION}
-ARG GO_VERSION=1.27.2
+ARG GO_VERSION=1.27.3
 ARG GO_IMAGE=golang:${GO_VERSION}
 FROM --platform=$BUILDPLATFORM $GO_IMAGE AS go
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx

contrib/Dockerfile.test

@@ -34,7 +34,7 @@
 #   docker run --privileged --group-add keep-groups -v ./critest_exit_code.txt:/tmp/critest_exit_code.txt containerd-test
 # ------------------------------------------------------------------------------
 
-ARG GOLANG_VERSION=1.27.2
+ARG GOLANG_VERSION=1.27.3
 ARG GOLANG_IMAGE=golang
 
 FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

contrib/fuzz/oss_fuzz_build.sh

@@ -39,11 +39,11 @@ compile_fuzzers() {
 
 apt-get update && apt-get install -y wget
 cd $SRC
-wget --quiet https://go.dev/dl/go1.27.2.linux-amd64.tar.gz
+wget --quiet https://go.dev/dl/go1.27.3.linux-amd64.tar.gz
 
 mkdir temp-go
 rm -rf /root/.go/*
-tar -C temp-go/ -xzf go1.27.2.linux-amd64.tar.gz
+tar -C temp-go/ -xzf go1.27.3.linux-amd64.tar.gz
 mv temp-go/go/* /root/.go/
 cd $SRC/containerd
 

script/setup/prepare_env_windows.ps1

@@ -5,7 +5,7 @@
 # lived test environment.
 Set-MpPreference -DisableRealtimeMonitoring:$true
 
-$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.27.2"; make = ""; nssm = "" }
+$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.27.3"; make = ""; nssm = "" }
 
 Write-Host "Downloading chocolatey package"
 curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

script/vm/provision.sh

@@ -32,7 +32,7 @@ fi
 script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)"
 containerd_dir="$(cd -- "${script_dir}/../.." > /dev/null 2>&1; pwd -P)"
 
-: "${GO_VERSION:=1.27.2}"
+: "${GO_VERSION:=1.27.3}"
 : "${RUNC_FLAVOR:=runc}"
 : "${SELINUX:=Enforcing}"
 : "${INSTALL_PACKAGES:=}"