fix(security): build releases with Go 1.27.3

CHANGELOG.md

@@ -1,7 +1,14 @@
 # Changelog
 
-## 0.1.8 (Unreleased)
+## 0.1.8 (2026-10-20)
 
+### Highlights
+
+- Fix certificate validation vulnerability GO-2026-6809 in release binaries.
+
+### Changes
+
+- Security: build with Go 1.27.3 to fix certificate validation vulnerability GO-2026-6809.
 - Breaking: macOS release binaries now require macOS 13 Ventura or newer, matching Go 1.27's supported minimum.
 - CI: move macOS jobs and release verification to `xcode-27` and smoke-test Intel binaries with Rosetta.
 - Security: build with Go 1.27.2 to fix standard-library vulnerabilities while retaining Go 1.25 source compatibility.

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.27
 
-ARG GO_VERSION=1.27.2
+ARG GO_VERSION=1.27.3
 ARG ALPINE_VERSION=3.24
 
 FROM golang:${GO_VERSION}-alpine AS build

README.md

@@ -77,7 +77,7 @@ The default config file is `~/Library/Application Support/blu/config.json` on ma
 
 ## Development
 
-CI and release builds use Go 1.27.2, while the source minimum remains Go 1.25.
+CI and release builds use Go 1.27.3, while the source minimum remains Go 1.25.
 macOS jobs run on the Apple Silicon `xcode-27` image and smoke-test Intel release
 binaries with Rosetta. Both macOS architectures require macOS 13.0 or newer.
 

cmd/blu/main.go

@@ -9,7 +9,7 @@ import (
 )
 
 var (
-	version = "0.1.7"
+	version = "0.1.8"
 	exit    = os.Exit
 )
 

docs/releasing.md

@@ -27,7 +27,7 @@ other than 13.0, including toolchain-default changes. If cgo is introduced, also
 set matching `CGO_CFLAGS` and `CGO_LDFLAGS` with `-mmacosx-version-min=13.0`;
 the environment variable alone does not reliably constrain external linking.
 CI exercises the same build configuration and target gate without Apple secrets.
-CI, releases, and Docker use Go 1.27.2; the source minimum remains Go 1.25.
+CI, releases, and Docker use Go 1.27.3; the source minimum remains Go 1.25.
 
 ## Dry run
 

go.mod

@@ -2,7 +2,7 @@ module github.com/steipete/blucli
 
 go 1.25.0
 
-toolchain go1.27.2
+toolchain go1.27.3
 
 require github.com/grandcat/zeroconf v1.0.0