From b60a157c3583966310e4c34e08a0074e5955a6af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20L=C3=B3pez=20O?=
 <sebastianlopezosorno2005@gmail.com>
Date: Sun, 1 Nov 2026 14:32:22 -0500
Subject: [PATCH] Pin the Go 1.27.3 toolchain so local builds skip vulnerable
 1.27.0-1.27.2 [skip deploy] #no-deploy

go 1.26.10 sets a minimum, so a developer machine with Go 1.27.0 still compiled with crypto/x509 affected by CVE-2026-111943 (fixed in 1.26.10 and 1.27.3). The toolchain line makes the go command switch to 1.27.3, the same version as the Docker build stage.
---
 go.mod | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/go.mod b/go.mod
index 4340e90..0f0eb60 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/SmartPotTech/SmartPot-API-Go
 
 go 1.26.10
 
+toolchain go1.27.3
+
 require (
 	github.com/eclipse/paho.mqtt.golang v1.5.1
 	github.com/golang-jwt/jwt/v5 v5.3.1