⚠️ Security
#2571 Update Go to v1.27.3
This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.
tfcmt relies on crypto/x509 to verify the TLS certificate of the GitHub API, and that connection carries your access token. We recommend upgrading.
ref.
- https://go.dev/doc/devel/release#go1.27.3
- https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
v4.14.19 was built with Go 1.27.0. This release also includes Go 1.27.2 (#2546), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.
⚠️ Changes of Release Assets
The tfcmt binary itself isn't affected, but the release assets for verification have changed.
- #2533
multiple.intoto.jsonlisn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead - #2589 A signed packslip
packslip.sigstore.jsonis published. You can verify downloaded assets with packslip
Dependency Updates
#2485 #2546 #2571 Update Go to v1.27.3
#2488 #2506 #2567 github.com/google/go-github/v93
#2505 #2516 #2531 github.com/urfave/cli/v3 v3.14.0
#2518 github.com/suzuki-shunsuke/urfave-cli-v3-util v0.2.4
#2490 golang.org/x/oauth2 v0.37.0
#2542 github.com/mattn/go-colorable v0.1.16