fix: upgrade Go to 1.26.7 and x/sys for CVEs [branch-4.0] - #2134
Merged
Conversation
Backport of the fix on master to branch-4.0. Addresses the findings Trivy reports against bin/pulsarctl in the sn-platform 4.0.12.3 image. Eight of the nine are Go stdlib (CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862) and come from the toolchain the binary is built with, so every go-version pin moves from 1.26.4 to 1.26.7 along with the go directive, including release.yml which builds the released binary. The fix landed in 1.26.6; staying on the 1.26 line this branch already uses avoids a language version jump. The ninth is CVE-2026-39824, an integer overflow in NewNTUnicodeString, fixed by x/sys 0.39.0 -> 0.44.0. Builds clean. go vet reports the same pre-existing finding in pkg/test/pulsar/standalone_test.go as master, unrelated to these upgrades.
|
@merlimat:Thanks for your contribution. For this PR, do we need to update docs? |
github-actions
Bot
added
the
doc-info-missing
style-check on this branch has been latently broken since #2095 moved the go directive to the 1.26 line: the pinned golangci-lint v2.7.2 is built with Go 1.25 and refuses to load a config targeting a newer language version ("the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version"). No PR had exercised the workflow on this branch since then, so the Go 1.26.7 bump surfaced it rather than caused it. v2.13.0 is the current release, built with Go 1.26. master and branch-4.2 stay on v2.7.2, which works there because their go directives are on the 1.25 line.
scan-vulnerabilities on this branch still used actions/setup-go@v1, which dies silently under the Node 24 runtime GitHub now forces on runners. master and branch-4.2 already use @v5 in the same workflow; this brings branch-4.0 in line. Like the golangci-lint pin, this was latent breakage surfaced by the first PR to exercise this branch's CI since June, not caused by the Go upgrade itself. release.yml stays on @v4, which works; only the broken @v1 is touched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #2133 to
branch-4.0— the line that produced thebin/pulsarctlTrivy scanned in
sn-platform:4.0.12.3. Companion tostreamnative/sn-pulsar-plugins#2719 and streamnative/streamnative-bom#588.
release.yml+godirective)golang.org/x/sys0.39.0 → 0.44.0This branch is on the 1.26 line (unlike master's 1.25), so it moves to 1.26.7;
the stdlib fix landed in 1.26.6. Notably this branch carries
release.ymlwith its own quoted
go-version: '1.26.4'pin — that's the workflow thatbuilds the released binary, and it's included here.
go.moddiff is exactly two lines. Builds clean;go vetshows only the samepre-existing
standalone_test.gofinding as master.Same fix in flight: #2133 (master), branch-4.2 PR.