Rebuild release binaries with Go 1.27.3 / 1.26.10 (crypto/x509 CA distrust fix) #32808

What happened?

The latest published Helm CLI binaries appear to be built with a Go toolchain that predates the recent crypto/x509 CA-distrust fix in the Go standard library.

Helm v4.3.1 linux/amd64 reports:

curl -fsSL -o helm.tgz https://get.helm.sh/helm-v4.3.1-linux-amd64.tar.gz
tar -xzf helm.tgz
go version -m ./linux-amd64/helm
# go1.27.2

That fix shipped in Go 1.27.3 (and Go 1.26.10 on the 1.26 line).

Upstream Go announce:
https://groups.google.com/g/golang-announce/c/66pojueaQek

What did you expect to happen?

A patch release whose official binaries are rebuilt with Go ≥ 1.27.3 (Helm 4) and/or Go ≥ 1.26.10 (Helm 3).

How can we reproduce it?

curl -fsSL -o helm.tgz https://get.helm.sh/helm-v4.3.1-linux-amd64.tar.gz
tar -xzf helm.tgz && go version -m ./linux-amd64/helm

Also checked: v3.22.1 → go1.26.9 (still below 1.26.10).

Extra notes

• About the released CLI binary’s embedded Go stdlib, not chart behavior.
• Install via get-helm.sh / get.helm.sh is common, so a rebuilt release helps broadly.
• Happy to verify a release candidate.

Helm version

v4.3.1 (GoVersion go1.27.2)