From b7e05b623ae398408c320553c3e5d2253eacc72b Mon Sep 17 00:00:00 2001 From: Matteo Merli Date: Wed, 19 Aug 2026 10:43:53 -0700 Subject: [PATCH] fix: upgrade Go to 1.25.14 and x/sys to 0.44.0 for CVEs Addresses the findings Trivy reports against bin/pulsarctl in the sn-platform 4.0.12.3 image. Eight of the nine are Go stdlib (CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862) and come from the toolchain the binary is built with, so every go-version pin moves from 1.25.12 to 1.25.14 along with the go directive. The fix landed in 1.25.13; staying on the 1.25 line avoids a language version jump. The ninth is CVE-2026-39824, an integer overflow in NewNTUnicodeString, fixed by x/sys 0.39.0 -> 0.44.0. Builds clean. go vet reports one pre-existing finding in pkg/test/pulsar/standalone_test.go that is unrelated to these upgrades. --- .github/workflows/ci-bookie-checks.yml | 4 ++-- .github/workflows/ci-functions-checks.yml | 12 ++++++------ .github/workflows/ci-packages-checks.yml | 4 ++-- .github/workflows/ci-release-checks.yml | 2 +- .github/workflows/ci-style-checks.yml | 4 ++-- .github/workflows/ci-trivy.yml | 4 ++-- go.mod | 4 ++-- go.sum | 4 ++-- 8 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/ci-bookie-checks.yml b/.github/workflows/ci-bookie-checks.yml index f03067206..1f98c9979 100644 --- a/.github/workflows/ci-bookie-checks.yml +++ b/.github/workflows/ci-bookie-checks.yml @@ -11,10 +11,10 @@ jobs: bookie-ut-tests: runs-on: ubuntu-latest steps: - - name: Set up Go 1.25.12 + - name: Set up Go 1.25.14 uses: actions/setup-go@v6 with: - go-version: 1.25.12 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-functions-checks.yml b/.github/workflows/ci-functions-checks.yml index d95f7dfea..2c18c81c9 100644 --- a/.github/workflows/ci-functions-checks.yml +++ b/.github/workflows/ci-functions-checks.yml @@ -14,10 +14,10 @@ jobs: - name: Login SN docker hub if: github.actor == 'streamnativebot' run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.25.12 + - name: Set up Go 1.25.14 uses: actions/setup-go@v6 with: - go-version: 1.25.12 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 @@ -34,10 +34,10 @@ jobs: - name: Login SN docker hub if: github.actor == 'streamnativebot' run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.25.12 + - name: Set up Go 1.25.14 uses: actions/setup-go@v6 with: - go-version: 1.25.12 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 @@ -51,10 +51,10 @@ jobs: - name: Login SN docker hub if: github.actor == 'streamnativebot' run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.25.12 + - name: Set up Go 1.25.14 uses: actions/setup-go@v6 with: - go-version: 1.25.12 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-packages-checks.yml b/.github/workflows/ci-packages-checks.yml index bf2d7ec7d..ec209c4d8 100644 --- a/.github/workflows/ci-packages-checks.yml +++ b/.github/workflows/ci-packages-checks.yml @@ -14,10 +14,10 @@ jobs: - name: Login SN docker hub if: github.actor == 'streamnativebot' run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.25.12 + - name: Set up Go 1.25.14 uses: actions/setup-go@v5 with: - go-version: 1.25.12 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-release-checks.yml b/.github/workflows/ci-release-checks.yml index 32484c442..5685e4ceb 100644 --- a/.github/workflows/ci-release-checks.yml +++ b/.github/workflows/ci-release-checks.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - go-version: [ 1.25.12 ] + go-version: [ 1.25.14 ] steps: - uses: actions/checkout@v2 - uses: actions/setup-go@v5 diff --git a/.github/workflows/ci-style-checks.yml b/.github/workflows/ci-style-checks.yml index 96e12c4c5..751ce4402 100644 --- a/.github/workflows/ci-style-checks.yml +++ b/.github/workflows/ci-style-checks.yml @@ -11,10 +11,10 @@ jobs: style-check: runs-on: ubuntu-latest steps: - - name: Set up Go 1.25.12 + - name: Set up Go 1.25.14 uses: actions/setup-go@v5 with: - go-version: 1.25.12 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-trivy.yml b/.github/workflows/ci-trivy.yml index 8418f2707..7010874a7 100644 --- a/.github/workflows/ci-trivy.yml +++ b/.github/workflows/ci-trivy.yml @@ -12,10 +12,10 @@ jobs: scan-vulnerabilities: runs-on: ubuntu-latest steps: - - name: Set up Go 1.25.12 + - name: Set up Go 1.25.14 uses: actions/setup-go@v5 with: - go-version: 1.25.12 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory diff --git a/go.mod b/go.mod index a182d101e..ec7e36aa5 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/streamnative/pulsarctl -go 1.25.12 +go 1.25.14 require ( github.com/apache/pulsar-client-go v0.18.0-candidate-1.0.20251222030102-3bb7d4eff361 @@ -93,7 +93,7 @@ require ( golang.org/x/mod v0.31.0 // indirect golang.org/x/net v0.48.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect - golang.org/x/sys v0.39.0 // indirect + golang.org/x/sys v0.44.0 // indirect golang.org/x/text v0.32.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect diff --git a/go.sum b/go.sum index 91c0b6e48..73d29d0e0 100644 --- a/go.sum +++ b/go.sum @@ -285,8 +285,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= -golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= +golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q= golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=