[ThomasRooney]

Why

The private keys of eight eMudhra (emSign) intermediate CA certificates were reported compromised (incident summary, Mozilla). Go 1.26.10 and 1.27.3 block those intermediates' public keys in crypto/x509, so certificate chains through them no longer verify.

Every release and CI workflow installs Go from go.mod, so this bump puts the block into released CLI binaries.

What changed

• go.mod: go 1.26.8 → go 1.26.10. No other Go version pins exist in the repository.

Testing

With Go 1.26.10: go build ./... and go vet ./... pass; go mod tidy makes no changes.

---

Summary by cubic

Bumps Go from 1.26.8 to 1.26.10 in go.mod — the only Go version pin in the repo — to pull in the crypto/x509 block on the compromised eMudhra/emSign intermediate CA keys. Since builds resolve the Go version from go.mod, the block applies to released CLI binaries.

Testing

• go build ./..., go vet ./..., and go mod tidy all pass with 1.26.10.

^{Written for commit c3fb89e. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Bumps Go from 1.26.8 to 1.26.10 in go.mod to pull in crypto/x509 blocks for compromised eMudhra/emSign CA keys; a one-line toolchain patch bump with tests clean, bounded and clearly beneficial.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[AshGodfrey]

go.mod is the only pin and CI/release install from it. LGTM.