[Release]: v1.3.0 security and Logger Preview #257

Unified release version

v1.3.0 for all 27 maintained public modules. Frozen tracer/xray is excluded.

Release scope and compatibility

Release the reviewed Go 1.27.3 security baseline, golang.org/x/crypto v0.58.0 graph, gRPC and Avro fixes, patched protobufjs reference tooling and accumulated Logger/JSON v2 improvements. Logger error stacks and handler panic logging are included with Preview status; these APIs remain unavailable in historical v1.2.0. Applications should rebuild Lambda binaries with the patched toolchain. Root Commons remains free of external Go dependencies.

Previous versions and accumulated changes

Previous project release: v1.2.0.

Reviewed source: 5667eb3b249c4761a13a5cb10f2a9d59988edd4a, including #256 and #260. The obsolete preparation PR #258 was closed without merging after supplementary npm advisories were found. No old plan or tag is reused. Refs #255 and #259.

Publication acceptance

• Review the frozen plan, one consolidated notes document and all 27 module versions at v1.3.0.
• Require contribution policy and complete PR/main CI on their exact commits, with CGO_ENABLED=0 and no race or cloud AWS testing.
• Merge the preparation PR only while its recorded source remains the first parent.
• Publish one stable project Release after all 27 immutable module tags and fresh public proxy/checksum consumer checks pass.
• Keep this issue open until publication succeeds; complete sanitized acceptance and current documentation under maintenance: update Go security patch and audit vulnerable dependencies #255.

Before publication

• The user authorized merging and publishing the reviewed unified release after checks pass.
• No credentials, personal profiles or raw cloud evidence are included.