Skip to content

fix(security): remediate CVE vulnerabilities - #603

Open
ulucinar wants to merge 1 commit into
mainfrom
fix/cve-remediation-main-20260724-170014
Open

fix(security): remediate CVE vulnerabilities#603
ulucinar wants to merge 1 commit into
mainfrom
fix/cve-remediation-main-20260724-170014

Conversation

@ulucinar

Copy link
Copy Markdown
Collaborator

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
GO-2026-5856 Medium stdlib (go1.25.11) go1.25.12
GO-2026-4970 High stdlib (go1.25.11) go1.25.12
GHSA-hrxh-6v49-42gf High google.golang.org/grpc v1.81.1 v1.82.1

Changes Made

  • Updated Go version from 1.25.11 to 1.25.12 in go.mod
  • Updated google.golang.org/grpc from v1.81.1 to v1.82.1 in go.mod
  • Updated GO_VERSION in .github/workflows/ci.yml to 1.25.12
  • Ran go mod tidy to update dependencies

References

Verification

  • Rescanned with `cve-scan` skill after fixes
  • All listed vulnerabilities resolved

- Update Go version to 1.25.12 (fixes GO-2026-5856, GO-2026-4970)
- Update google.golang.org/grpc to v1.82.1 (fixes GHSA-hrxh-6v49-42gf)

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

@ezgidemirel ezgidemirel left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @ulucinar

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants