From 69a611e627dc241c08ddb205c0d46a5e3b8112dc Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Wed, 21 Oct 2026 10:18:31 -0700
Subject: [PATCH 1/2] chore: build with Go 1.27.3

---
 CONTRIBUTING.md | 2 +-
 Dockerfile      | 2 +-
 README.md       | 2 +-
 go.mod          | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6e5af560..7c47f5fd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -10,7 +10,7 @@ just build     # browser assets, then the binary
 just check     # the full gate
 ```
 
-You need Go 1.27.2 and a C/C++ toolchain on native Linux or macOS (amd64 or arm64),
+You need Go 1.27.3 and a C/C++ toolchain on native Linux or macOS (amd64 or arm64),
 [Bun](https://bun.sh), Node.js 24.19.0, [just](https://just.systems),
 [golangci-lint](https://golangci-lint.run/), and
 [Lefthook](https://github.com/evilmartians/lefthook). Running in local auth mode
diff --git a/Dockerfile b/Dockerfile
index 3713f60a..c305dc1e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@ RUN cd ui/host && bun run build
 # is no cross toolchain here. `--platform=$BUILDPLATFORM` is therefore only
 # correct while TARGETPLATFORM equals BUILDPLATFORM. Adding an architecture to
 # the CI matrix means either a native runner for it or QEMU, not a GOARCH flag.
-FROM --platform=$BUILDPLATFORM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 AS build
+FROM --platform=$BUILDPLATFORM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION=dev
diff --git a/README.md b/README.md
index 0177bce6..34ec1324 100644
--- a/README.md
+++ b/README.md
@@ -172,7 +172,7 @@ quality gate. See the [performance methodology](https://fanout.run/explanation/p
 
 ## Build from source
 
-- **Go 1.27.2 and a C/C++ toolchain** on native Linux or macOS, amd64 or arm64.
+- **Go 1.27.3 and a C/C++ toolchain** on native Linux or macOS, amd64 or arm64.
   Build with `just build` or `bash scripts/with-duckdb.sh go build ./cmd/fanout`;
   the wrapper supplies DuckDB's pinned headers, static libraries, and CGO flags.
   The first build needs network access to download the checksum-verified engine.
diff --git a/go.mod b/go.mod
index 81e0411b..02826021 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/labstack/fanout
 
-go 1.27.2
+go 1.27.3
 
 require (
 	cel.dev/cel-go v0.32.0

From 45f5abca70c4e65eea6a791680c4456e907d0ead Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Wed, 21 Oct 2026 10:37:30 -0700
Subject: [PATCH 2/2] chore: refresh the Chainguard runtime image

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index c305dc1e..c2366dfa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,7 +36,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 # directory here, then copy it with the runtime user's ownership below.
 RUN mkdir -p /runtime/var/lib/fanout/data
 
-FROM cgr.dev/chainguard/glibc-dynamic:latest@sha256:205572d5e48117e14b44b42627890fa8d3e8e65bb37a80abb3317e5151e7f35b AS fanout
+FROM cgr.dev/chainguard/glibc-dynamic:latest@sha256:3f1283dc2a6a48c25cd2e1c7730a871b19b721975240e108e0d6a73b555a3a20 AS fanout
 ARG VERSION=dev
 
 LABEL org.opencontainers.image.title="Fanout" \