[AB1Pass]

Go 1.26.10 (and 1.27.3), released 2026-10-19, add a crypto/x509 block of the public keys of the eight eMudhra intermediate CAs whose private keys were disclosed and which were revoked on 2026-10-18. With it, binaries built from this module reject chains signed by those keys regardless of whether the host trust store still contains emSign ECC Root CA - G3. On Linux Go otherwise relies entirely on the host CA bundle.

One-line go.mod change; CI picks the toolchain up from go.mod via go-version-file. Context: 1Password InfraSec response to the eMudhra advisory, tracked as INFRASEC-1824.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[RebeccaMahany]

Handled in #94

[AB1Pass]

CI note: govulncheck fails on four newly published Go vulnerability IDs (GO-2026-6603, GO-2026-6611, GO-2026-6612, GO-2026-6617; the reachable one is #1 GO-2026-6617 via golang.org/x/net http2). These are new database entries, not something the Go 1.26.10 bump introduced, and main will report the same on its next run. Fixing them is a golang.org/x/net bump; I left it out of this PR to keep the toolchain change on its own.