From 764e07ca16c18656d73466ae3f31e4011d84019a Mon Sep 17 00:00:00 2001
From: Andrea Cappelletti <andreacappelletti97@gmail.com>
Date: Fri, 23 Oct 2026 14:29:31 -0400
Subject: [PATCH] release: v0.3.21

---
 .github/workflows/catalog-drift.yml |  2 +-
 .github/workflows/ci.yml            |  6 +++---
 .github/workflows/release.yml       |  2 +-
 CHANGELOG.md                        | 10 ++++++++++
 4 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/catalog-drift.yml b/.github/workflows/catalog-drift.yml
index c6fd208..fe8837c 100644
--- a/.github/workflows/catalog-drift.yml
+++ b/.github/workflows/catalog-drift.yml
@@ -32,7 +32,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
 
       - name: Run verifier (strict)
         id: verify
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c24e11b..488a930 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
           cache: true
       - name: gofmt
         run: |
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
           cache: true
       - uses: golangci/golangci-lint-action@v8
         with:
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
           cache: true
       # Offline mode skips network — fast smoke that the catalog loads
       # and every kind has a fixture. The full live verifier runs on
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 126dba9..1a3e9f2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 646db67..c8274f2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,16 @@ uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.21] - 2026-10-23
+
+### Security
+
+- Release binaries are built with Go 1.27.3, which fixes GO-2026-6809:
+  `crypto/x509` trusted compromised intermediate certificates when
+  verifying TLS connections (pricing API, module and catalog downloads).
+  CI and the release workflow now pin the exact Go version, so a runner's
+  cached older patch release can't be used.
+
 ### Fixed
 
 - Module outputs are now evaluated (#116). An expression reading