[iperev]

Release blocker for 0.17.0. The release candidate run on main (75caaf1) failed at go:vulncheck: govulncheck reports GO-2026-6809 (crypto/x509 distrusts compromised intermediate certificates), published after main's last CI run, as reachable in Go 1.27.2 through the CLI's diagnostic output path. Go 1.27.3 contains the fix. Every source gate on main will fail the same way until this merges.

What changes

• go.mod: toolchain go1.27.3. The go directive and every module requirement are unchanged.
• release/change-record.v2.json: the toolchain addition states that release binaries are built with Go 1.27.3 and why; the pinned copy in internal/tools/releasechange/record_test.go is regenerated from it.

Compatibility

Not breaking. No command, flag, contract or output changes; release binaries are rebuilt with a patched standard library.

Proof

• A local npm run check sequence on darwin/arm64 passed (exit 0) on tree f7cfc5f6bd9a with npm 12.2.0, CPython 3.15.0 and Go 1.27.3: 561/561 browser cases in Chromium, Firefox and WebKit with zero retries.
• One recorded deviation: the host firewall blocks Go-built binaries from the network, so the go:vulncheck step ran govulncheck against a vulnerability-database snapshot fetched with curl (modified 2026-10-21T00:27:29Z): no vulnerabilities. With the same snapshot, Go 1.27.2 is reported affected by GO-2026-6809. Hosted CI runs govulncheck against the live database.

Non-claims

• Not a release: no tag or registry publication.
• No claim about vulnerabilities published after the snapshot date beyond what hosted CI reports.

[iperev]

Security prerequisite delivery

• Contract: every merged intermediate must pass mandatory source/security gates;
  a later repair cannot qualify earlier red commits.
• Counterexample: OSV run40059109279/job120768541993 failed for PR232. Its
  retained SARIF identifies fast-uri3.1.8 and four advisories: CVE-2026-110725,
  CVE-2026-110306, CVE-2026-110180 and CVE-2026-110095.
• Correction and scope: the exact three-line fast-uri3.1.9 lock repair proposed
  in PR236 was delivered in PR228, alongside the reviewed Go1.27.3 patch. The
  URI parser is Ajv's development dependency, not a new product runtime module.
• Rejected alternatives: bypass/exempt OSV, merge red intermediates, unnecessarily
  upgrade Ajv, or claim that Playwright's independently bundled copy was fixed.
• Preservation: pinned install resolves Ajv8.20.0 -> fast-uri3.1.9; five actual
  compact-schema/CLI tests and releasechange tests passed. Two independent source
  reviews found no blocking defect. All ten fresh GitHub checks passed on the
  signed candidate, with only two expected provider-upload skips.
• Merge readback: cb241f2 is a verified signed
  single-parent squash, exact reviewed tree5a015aff3d27ae8961d3dd2abd14c37d1d1ae5ef,
  empty body. An advisory finding alone is not proof of product exploitability;
  inlined browser-tool debt remains separately recorded.