fix(security): build Hub with Go 1.27.3 and the patched CA store [ENG-4067]

.github/workflows/api-contract-tests.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
 
       - name: Cache Go modules
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

.github/workflows/code-quality.yml

@@ -39,7 +39,7 @@ jobs:
         id: setup-go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
 
       - name: Cache Go modules
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

.github/workflows/migrations-validate.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
 
       - name: Install goose
         run: go install github.com/pressly/goose/v3/cmd/goose@v3.28.0

.github/workflows/tests.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
 
       - name: Cache Go modules
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -85,7 +85,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
 
       - name: Cache Go modules
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -148,7 +148,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.2'
+          go-version: '1.27.3'
 
       - name: Cache Go modules
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

.golangci.yml

@@ -9,7 +9,7 @@ run:
   timeout: 5m
   concurrency: 4
   modules-download-mode: readonly
-  go: "1.27.2"
+  go: "1.27.3"
   # Allow linting test files but suppress specific strict rules via exclusion below
   tests: true
 

Dockerfile

@@ -2,7 +2,7 @@
 # Stage 1: Build
 # =============================================================================
 # TARGETOS/TARGETARCH are set by Docker Buildx for multi-platform builds (e.g. linux/arm64 on Mac M1).
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 ARG TARGETOS=linux
 ARG TARGETARCH
 ARG GOOSE_VERSION=v3.28.0
@@ -52,7 +52,13 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /build/bin/h
 FROM alpine:3.24
 
 # Require the patched zlib even when the base image contains an older package (CVE-2026-85091).
-RUN apk add --no-cache ca-certificates tzdata wget 'zlib>=1.3.2-r1'
+# Require the CA store that drops emSign ECC Root CA - G3 after the October 2026 eMudhra
+# intermediate CA compromise. Both packages are pinned: plain `apk add ca-certificates`
+# regenerates the bundle file but leaves the base image's older ca-certificates-bundle installed.
+# Require OpenSSL 3.5.9 (busybox wget's TLS and apk) over the base image's 3.5.8.
+RUN apk add --no-cache ca-certificates tzdata wget 'zlib>=1.3.2-r1' \
+	'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0' \
+	'libssl3>=3.5.9-r0' 'libcrypto3>=3.5.9-r0'
 
 # Create non-root user
 RUN addgroup -S app && adduser -S app -G app

go.mod

@@ -1,6 +1,6 @@
 module github.com/formbricks/hub
 
-go 1.27.2
+go 1.27.3
 
 require (
 	github.com/go-playground/form/v4 v4.5.0