Skip to content

fix(security): remediate CVE vulnerabilities - #222

Merged
ulucinar merged 1 commit into
release-0.6from
fix/cve-remediation-release-0.6-20260724-152722
Jul 24, 2026
Merged

fix(security): remediate CVE vulnerabilities#222
ulucinar merged 1 commit into
release-0.6from
fix/cve-remediation-release-0.6-20260724-152722

Conversation

@ulucinar

@ulucinar ulucinar commented Jul 24, 2026

Copy link
Copy Markdown
Collaborator

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
GO-2026-5856 Medium stdlib go1.25.12
GO-2026-4970 High stdlib go1.25.12
GO-2026-5970 High golang.org/x/text v0.39.0
GO-2026-5942 High golang.org/x/net v0.56.0
GHSA-hrxh-6v49-42gf High google.golang.org/grpc v1.82.1

Changes Made

  • Updated Go version from 1.25.11 to 1.25.12 (fixes GO-2026-5856, GO-2026-4970)
  • Updated golang.org/x/text from v0.37.0 to v0.39.0 (fixes GO-2026-5970)
  • Updated golang.org/x/net from v0.55.0 to v0.56.0 (fixes GO-2026-5942)
  • Updated google.golang.org/grpc from v1.79.3 to v1.82.1 (fixes GHSA-hrxh-6v49-42gf)
  • Updated CI workflow to use Go 1.25.12
  • Ran go mod tidy to update dependencies

References

Verification

  • Rescanned with cve-scan skill after fixes
  • All listed vulnerabilities resolved

@ulucinar
fix(security): remediate CVE vulnerabilities
b9d5306 
- Update Go version to 1.25.12 (fixes GO-2026-5856, GO-2026-4970)
- Update golang.org/x/text to v0.39.0 (fixes GO-2026-5970)
- Update golang.org/x/net to v0.56.0 (fixes GO-2026-5942)
- Update google.golang.org/grpc to v1.82.1 (fixes GHSA-hrxh-6v49-42gf)
- Update CI workflow to use Go 1.25.12

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
@bobh66

bobh66 commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Can we fix this on main and cherrypick/backport to the release branch?

@bobh66

bobh66 commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Also release-0.7 is latest

@bobh66

bobh66 commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Maybe we need to get renovate to run on the release branches? That might be the best solution.

@ulucinar

ulucinar commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Hi @bobh66,
Thank you again for jumping into a call to discuss the strategy, and such a great pleasure to meet you!
As we've discussed, we will check the renovate configurations in the main branches for these official functions and I'll also make sure in the future, in these rounds of CVE fixes, we also target the main branches in addition to directly targeting the release branches.

Some context for the other readers here: With so many release branches we are maintaining in the ecosystem, it's operationally easier for us to target the release branches for CVE fixes directly, instead of going through the main. But nothing prevents us from targeting the main branch directly as well (as mentioned above).

@ulucinar

ulucinar commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

I'll give targeting the main branch a try after merging this PR. I'll also chat with @erhancagirici regarding the renovate configurations in main.

@ulucinar
ulucinar merged commit 07e2130 into release-0.6 Jul 24, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@turkenf turkenf turkenf approved these changes
@sergenyalcin sergenyalcin Awaiting requested review from sergenyalcin sergenyalcin is a code owner
@negz negz Awaiting requested review from negz negz is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@ulucinar @bobh66 @turkenf