release: v0.3.21

.github/workflows/catalog-drift.yml

@@ -32,7 +32,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
 
       - name: Run verifier (strict)
         id: verify

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
           cache: true
       - name: gofmt
         run: |
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
           cache: true
       - uses: golangci/golangci-lint-action@v8
         with:
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
           cache: true
       # Offline mode skips network — fast smoke that the catalog loads
       # and every kind has a fixture. The full live verifier runs on

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.27'
+          go-version: '1.27.3'
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3

CHANGELOG.md

@@ -6,6 +6,16 @@ uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.21] - 2026-10-23
+
+### Security
+
+- Release binaries are built with Go 1.27.3, which fixes GO-2026-6809:
+  `crypto/x509` trusted compromised intermediate certificates when
+  verifying TLS connections (pricing API, module and catalog downloads).
+  CI and the release workflow now pin the exact Go version, so a runner's
+  cached older patch release can't be used.
+
 ### Fixed
 
 - Module outputs are now evaluated (#116). An expression reading