Go module upgrades to fix CVE-2025-22872#675
Merged
Merged
Conversation
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR upgrades the Go module versions—including the x/net module—to address CVE-2025-22872 while updating the tests to use the new t.Context() helper and fixing go vet warnings.
- Upgraded module versions and Go version in go.mod
- Replaced context.Background()/context.TODO() with t.Context() in multiple tests
- Adjusted logging calls (including formatting strings) in test code
Reviewed Changes
Copilot reviewed 11 out of 12 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/logs/logs_test.go | Updated context usage and modified logging calls |
| pkg/internal/cyberark/servicediscovery/discovery_test.go | Replaced context.Background() with t.Context() |
| pkg/internal/cyberark/identity/start_authentication_test.go | Replaced context.Background() with t.Context() |
| pkg/internal/cyberark/identity/advance_authentication_test.go | Replaced context.Background() with t.Context() |
| pkg/internal/cyberark/dataupload/dataupload_test.go | Replaced context.TODO() with t.Context() |
| pkg/echo/echo_test.go | Replaced context.TODO() with t.Context() |
| pkg/datagatherer/k8s/dynamic_test.go | Replaced context.Background() with t.Context() in several test cases |
| pkg/client/client_venconn_test.go | Updated context creation using t.Context() with cancellation |
| pkg/agent/config_test.go | Updated context usage and YAML tests |
| go.mod | Upgraded Go version and various dependency versions |
| cmd/agent_test.go | Replaced context.Background() with t.Context() in the command test |
Comments suppressed due to low confidence (1)
pkg/logs/logs_test.go:412
- Ensure that the replacement of logger.Printf with logger.Print retains the intended formatting behavior, especially if any format specifiers were expected. If formatting is required, consider using logger.Printf with an appropriate format string.
logger.Print(line)
wallrj
commented
Jun 24, 2025
| for _, line := range strings.Split(given, "\n") { | ||
| // Simulate the current agent's logs. | ||
| logger.Printf(line) // nolint:staticcheck | ||
| logger.Print(line) |
Contributor
Author
There was a problem hiding this comment.
@maelvls I wasn't sure about this. This nolint annotation no longer works, and I couldn't find a working nolint trick. So I changed printf to print. Does that invalidate these tests?
Member
There was a problem hiding this comment.
Unless I misunderstand the point of this test, I think you can remove this test entirely since there aren't any log.Fatal or log.Print calls anymore:
$ rg 'log\.(Print|Fatal)'
pkg/logs/logs.go
126: // the agent, which still uses log.Printf.
151: // log.Printf writes a newline at the end of the message, so we need to trim
pkg/logs/logs_test.go
59: log.Print("log Print")
Back when we added this test case in 415d434, there were many more lines:
pkg/agent/config.go: log.Printf("Using the %s auth mode since --venafi-cloud and --credentials-path were specified.", mode)
pkg/agent/config.go: log.Printf("Using the %s auth mode since --client-id and --private-key-path were specified.", mode)
pkg/agent/config.go: log.Printf("Using the %s auth mode since --venafi-connection was specified.", mode)
pkg/agent/config.go: log.Printf("Using the %s auth mode since --api-token was specified.", mode)
pkg/agent/config.go: log.Printf("Using the %s auth mode since --credentials-file was specified without --venafi-cloud.", mode)
pkg/agent/config.go: log.Printf("The `server` and `endpoint` fields are both set in the config; using the `server` field.")
pkg/agent/config.go: log.Printf("Using deprecated Endpoint configuration. User Server instead.")
pkg/agent/config.go: log.Printf("ignoring the server field specified in the config file. In %s mode, this field is not needed.", VenafiCloudVenafiConnection)
pkg/agent/config.go: log.Printf(`ignoring the venafi-cloud.upload_path field in the config file. In %s mode, this field is not needed.`, res.AuthMode)
pkg/agent/config.go: log.Printf(`ignoring the venafi-cloud.uploader_id field in the config file. This field is not needed in %s mode.`, res.AuthMode)
pkg/agent/config.go: log.Printf("Using period from config %s", cfg.Period)
pkg/agent/config.go: log.Printf("Both the 'period' field and --period are set. Using the value provided with --period.")
pkg/agent/config.go: log.Println("Loading upload_path from \"venafi-cloud\" configuration.")
pkg/logs/logs.go: // the agent, which still uses log.Printf.
pkg/logs/logs.go: // log.Printf writes a newline at the end of the message, so we need to trim
pkg/logs/logs_test.go: log.Print("log Print")
Contributor
Author
There was a problem hiding this comment.
Ah, yes. I vaguely remember. Thanks. Test now deleted.
We have since replaced all the calls to log.Print and log.Fatal Signed-off-by: Richard Wall <richard.wall@cyberark.com>
maelvls
approved these changes
Jun 25, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: CVE-2025-22872
Mostly mechanical changes to upgrade the Go module version and the
x/netmodule to fix a CVE reported by trivy:Then I had to go and update the tests to use the new
t.Contexthelper and fix somego vetwarnings which started showing up.Testing
Current Release:
Before:
After: