From bd97749e8e63e3369a7216eb3a523e0157995f30 Mon Sep 17 00:00:00 2001
From: Waldo Malqui <waldo@malqui.info>
Date: Sun, 23 Aug 2026 12:43:12 -0500
Subject: [PATCH] fix: upgrade Go to 1.27.0 to resolve stdlib CVEs

Docker Hub vulnerability scanning flagged golang/stdlib issues on the
previous Go 1.26.4 toolchain. Bump builder and module to Go 1.27.0 to
match the version Chainguard's base image build already uses.

- go.mod: go 1.26.2 -> 1.27.0
- Dockerfile: golang:1.26-alpine -> golang:1.27-alpine builder stage
- README.md: update stated minimum Go version
- VERSION: v0.4.0 -> v0.4.1
- CHANGELOG.md: add [0.4.1] entry
---
 CHANGELOG.md | 9 ++++++++-
 Dockerfile   | 2 +-
 README.md    | 2 +-
 VERSION      | 2 +-
 go.mod       | 2 +-
 5 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c0d00f..86004ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-08-23
+
+### Fixed
+
+- **Go upgraded to 1.27.0** — resolves stdlib CVEs flagged by Docker Hub image scanning; base builder image bumped to `golang:1.27-alpine` to match the Chainguard toolchain version.
+
 ## [0.4.0] - 2026-06-30
 
 ### Added
@@ -58,7 +64,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Multi-arch container** — supports `linux/amd64` and `linux/arm64`; ARM64 (Graviton) preferred for lower cost and better performance-per-watt
 - **Build-time version embedding** — version string injected via `-ldflags` and logged at startup
 
-[Unreleased]: https://github.com/fayrus/syncret/compare/v0.4.0...HEAD
+[Unreleased]: https://github.com/fayrus/syncret/compare/v0.4.1...HEAD
+[0.4.1]: https://github.com/fayrus/syncret/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/fayrus/syncret/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/fayrus/syncret/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/fayrus/syncret/compare/v0.1.0...v0.2.0
diff --git a/Dockerfile b/Dockerfile
index 8b15164..8b6c109 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.27-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/README.md b/README.md
index 3ecad64..06c9c68 100644
--- a/README.md
+++ b/README.md
@@ -89,7 +89,7 @@ make tidy          # go mod tidy
 make docker-build  # build multi-arch image (linux/amd64 + linux/arm64)
 ```
 
-Requires Go 1.26+.
+Requires Go 1.27+.
 
 ---
 
diff --git a/VERSION b/VERSION
index fb7a04c..5aff472 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-v0.4.0
+v0.4.1
diff --git a/go.mod b/go.mod
index 1a26c5a..b3593fd 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/fayrus/syncret
 
-go 1.26.2
+go 1.27.0
 
 require (
 	github.com/aws/aws-lambda-go v1.54.0