all: build with Go 1.27.3

crypto/x509 security fixes.

AGENTS.md

@@ -66,7 +66,7 @@ similar lines of code is better than a premature abstraction.
 ## Quick Start
 
 ```bash
-# Enter the nix dev shell (Go 1.27.2, buf, golangci-lint, prek)
+# Enter the nix dev shell (Go 1.27.3, buf, golangci-lint, prek)
 nix develop
 
 # Full development workflow: fmt + lint + test + build
@@ -93,7 +93,7 @@ go run ./tools/bump plan     # what is stale, changes nothing
 go run ./tools/bump verify   # do the pins still agree
 ```
 
-Go 1.27.2 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain
+Go 1.27.3 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain
 used in CI.
 
 ## Pre-Commit with prek

CHANGELOG.md

@@ -127,7 +127,7 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`,
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
 - Fix `headscale users destroy`/`rename` reporting "multiple users match query" when no user matches; an ambiguous match now lists the matching users [#3476](https://github.com/juanfont/headscale/pull/3476)
 - Deleting a user that still owns nodes now lists the nodes (ID and hostname) that must be deleted first [#3475](https://github.com/juanfont/headscale/pull/3475)
-- Headscale now requires Go 1.27 to build
+- Headscale now requires Go 1.27.3 to build, which carries the `crypto/x509` security fixes [#3560](https://github.com/juanfont/headscale/pull/3560)
 - `headscale preauthkeys create --user` accepts a user name as well as an ID
 - `derp.paths` files may be Tailscale JSON or HuJSON DERP maps as well as YAML
 - `dns.extra_records_path` files may be HuJSON or YAML as well as JSON

Dockerfile.integration

@@ -2,7 +2,7 @@
 # and are in no way endorsed by Headscale's maintainers as an
 # official nor supported release or distribution.
 
-FROM docker.io/golang:1.27.2-trixie AS builder
+FROM docker.io/golang:1.27.3-trixie AS builder
 ARG VERSION=dev
 ENV GOPATH /go
 WORKDIR /go/src/headscale

Dockerfile.wasmclient

@@ -7,7 +7,7 @@
 # to drive a real browser-style WebSocket GET against headscale's /ts2021,
 # guarding the regression in issue #3357.
 
-FROM golang:1.27.2-alpine AS build
+FROM golang:1.27.3-alpine AS build
 
 WORKDIR /src
 

cmd/hi/README.md

@@ -55,7 +55,7 @@ changing.
 | `--timeout`         | `120m`         | Total test timeout. Use the built-in flag — never wrap with bash `timeout`. |
 | `--postgres`        | `false`        | Use PostgreSQL instead of SQLite                                            |
 | `--failfast`        | `true`         | Stop on first test failure                                                  |
-| `--go-version`      | auto           | Detected from `go.mod` (currently 1.27.0)                                   |
+| `--go-version`      | auto           | Detected from `go.mod` (currently 1.27.3)                                   |
 | `--test-binary`     | unset          | Execute a precompiled integration test binary instead of running `go test`  |
 | `--clean-before`    | `true`         | Clean stale (stopped/exited) containers before starting                     |
 | `--clean-after`     | `true`         | Clean this run's containers after completion                                |

cmd/hi/run.go

@@ -113,7 +113,7 @@ func detectGoVersion() string {
 	if err != nil {
 		content, err = os.ReadFile(filepath.Join("..", "..", "go.mod"))
 		if err != nil {
-			return "1.27.0"
+			return "1.27.3"
 		}
 	}
 
@@ -125,5 +125,5 @@ func detectGoVersion() string {
 		}
 	}
 
-	return "1.27.0"
+	return "1.27.3"
 }