[PyYoshi]

Summary

Raise the Go toolchain floor in go.mod from 1.27.2 to 1.27.3.

go1.27.3 (released 2026-10-19) carries a single security fix: GO-2026-6809 (CVE-2026-111943), a denylist in crypto/x509 that makes Certificate.Verify reject known compromised intermediate certificates. It lists no bug fixes.

On go1.27.2, govulncheck reports GO-2026-6809 at package level only, so the scan still passes: in non-test code crypto/x509 is reached solely through net/http in examples/httpupload (the root package's tests also import net/http), and no code here calls Certificate.Verify. The floor is raised now, following the earlier patch bumps (1.26.5, 1.26.6), so it carries current stdlib security fixes before a finding reaches a called symbol. CI resolves the toolchain through go-version-file: go.mod, and older local toolchains fetch it via GOTOOLCHAIN=auto.

• go.mod: go 1.27.2 → go 1.27.3 (no toolchain line, no require).
• CHANGELOG.md: a Changed entry under [Unreleased]. Downstream modules need go 1.27.3 or later.
• README.md, README.ja.md and CONTRIBUTING.md say "Go 1.27+", which is still accurate (same precedent as the 1.26.x patch bumps), so they are unchanged.

No public API, wire-protocol or security-default change, so no ADR is needed.

Checklist

• make verify passes locally (build + lint + tests) — on go1.27.3: golangci-lint 0 issues, govulncheck -show verbose reports no vulnerabilities at any level, unit tests and the 397-row guard table pass
• make integration passes (required when client.go / conn.go / commands.go / internal/proto/ / docker/ changed) — not required here (none of those changed); run anyway, locally on go1.27.3 against the default clamav 1.5 image; CI covers 1.4 and 1.5
• README.md and README.ja.md updated together, or the change touches neither
• CHANGELOG.md updated under [Unreleased] for user-visible changes
• No new dependencies, no assembled EICAR string, no weakened guards; design changes reference an ADR
• Reviewed against the AGENTS.md Review checklist by someone other than the author, covering the merged commit (recorded in the PR); every finding fixed or answered

Review record

Independent review by a fresh reviewer agent (not the authoring session) against the AGENTS.md Review checklist and the Definition of Done. Reviewed commit: 3df38751712a51d83e82f770d82bf029df4aff1d (origin/main..3df3875, the whole PR). Recommendation: APPROVE. No critical, major or minor findings; all Critical checklist items checked with nothing found. The reviewer independently confirmed the go1.27.3 release contents (milestone holds only the CVE-2026-111943 backport), the GO-2026-6809 advisory, govulncheck results on both toolchains (also with -test), CI resolving exactly go1.27.3, and that no other file references or resolves the Go version.

#	Severity	Finding	Resolution
1	nit	"crypto/x509 is reached solely through net/http in examples/httpupload" holds for non-test code only: client_test.go imports net/http, so the root package's test binary also links crypto/x509 (govulncheck -test is still clean)	Fixed in this PR description. The signed commit message is left as is, since amending it would need a force push.