[aikido-autofix]

Upgrade Go to fix certificate verification bypass allowing HTTPS server impersonation via compromised eMudhra intermediate CA keys.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-934590	HIGH	[go] certificate verification did not reject the known compromised eMudhra intermediate public keys. An attacker able to intercept a connection can use a compromised eMudhra intermediate CA key to impersonate an HTTPS server and read or modify traffic.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-21567

🤖 Remediation details

Security fix: this PR raises the Go toolchain version (go) in lib/request-processor/go.mod from 1.27.2 to the patched 1.27.3 (AIKIDO-2026-934590). Only the go directive changed. No other module versions moved.

go

The go directive in lib/request-processor/go.mod was on 1.27.2, which is inside the affected range (>=1.27.0 <=1.27.2). It was raised to 1.27.3, the lowest patched release on the 1.27 line, with go get go@1.27.3 followed by go mod tidy. lib/agent doesn't depend on lib/request-processor, so it was not touched. No go.work file exists, so no workspace sync was needed. go build ./... in lib/request-processor fails with package main/ipc/protos is not in std in aikido_types/handle.go. It failed identically before the change, and it was not addressed here.

Version changes

Package	From	To	Why updated
go (lib/request-processor/go.mod directive)	1.27.2	1.27.3	Direct fix for the vulnerable Go version (AIKIDO-2026-934590)

[aikido-autofix]

Closed by Aikido: the vulnerability is already resolved.