From 8d0118a6855e989022067c63665a43355694f363 Mon Sep 17 00:00:00 2001 From: Matteo Merli Date: Wed, 19 Aug 2026 17:27:58 -0700 Subject: [PATCH 1/3] fix: upgrade Go to 1.26.7 and x/sys to 0.44.0 for CVEs Backport of the fix on master to branch-4.0. Addresses the findings Trivy reports against bin/pulsarctl in the sn-platform 4.0.12.3 image. Eight of the nine are Go stdlib (CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862) and come from the toolchain the binary is built with, so every go-version pin moves from 1.26.4 to 1.26.7 along with the go directive, including release.yml which builds the released binary. The fix landed in 1.26.6; staying on the 1.26 line this branch already uses avoids a language version jump. The ninth is CVE-2026-39824, an integer overflow in NewNTUnicodeString, fixed by x/sys 0.39.0 -> 0.44.0. Builds clean. go vet reports the same pre-existing finding in pkg/test/pulsar/standalone_test.go as master, unrelated to these upgrades. --- .github/workflows/ci-bookie-checks.yml | 4 ++-- .github/workflows/ci-functions-checks.yml | 12 ++++++------ .github/workflows/ci-packages-checks.yml | 4 ++-- .github/workflows/ci-release-checks.yml | 2 +- .github/workflows/ci-style-checks.yml | 4 ++-- .github/workflows/ci-trivy.yml | 4 ++-- .github/workflows/release.yml | 2 +- go.mod | 4 ++-- go.sum | 4 ++-- 9 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/ci-bookie-checks.yml b/.github/workflows/ci-bookie-checks.yml index 1d207297c..29ca64a0f 100644 --- a/.github/workflows/ci-bookie-checks.yml +++ b/.github/workflows/ci-bookie-checks.yml @@ -11,10 +11,10 @@ jobs: bookie-ut-tests: runs-on: ubuntu-latest steps: - - name: Set up Go 1.26.4 + - name: Set up Go 1.26.7 uses: actions/setup-go@v6 with: - go-version: 1.26.4 + go-version: 1.26.7 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-functions-checks.yml b/.github/workflows/ci-functions-checks.yml index 46b32d511..26584af4c 100644 --- a/.github/workflows/ci-functions-checks.yml +++ b/.github/workflows/ci-functions-checks.yml @@ -13,10 +13,10 @@ jobs: steps: - name: Login SN docker hub run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.26.4 + - name: Set up Go 1.26.7 uses: actions/setup-go@v6 with: - go-version: 1.26.4 + go-version: 1.26.7 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 @@ -30,10 +30,10 @@ jobs: steps: - name: Login SN docker hub run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.26.4 + - name: Set up Go 1.26.7 uses: actions/setup-go@v6 with: - go-version: 1.26.4 + go-version: 1.26.7 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 @@ -44,10 +44,10 @@ jobs: steps: - name: Login SN docker hub run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.26.4 + - name: Set up Go 1.26.7 uses: actions/setup-go@v6 with: - go-version: 1.26.4 + go-version: 1.26.7 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-packages-checks.yml b/.github/workflows/ci-packages-checks.yml index 588999ced..04c01ac52 100644 --- a/.github/workflows/ci-packages-checks.yml +++ b/.github/workflows/ci-packages-checks.yml @@ -13,10 +13,10 @@ jobs: steps: - name: Login SN docker hub run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}" - - name: Set up Go 1.26.4 + - name: Set up Go 1.26.7 uses: actions/setup-go@v5 with: - go-version: 1.26.4 + go-version: 1.26.7 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-release-checks.yml b/.github/workflows/ci-release-checks.yml index 82392e462..5229d48ff 100644 --- a/.github/workflows/ci-release-checks.yml +++ b/.github/workflows/ci-release-checks.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - go-version: [ 1.26.4 ] + go-version: [ 1.26.7 ] steps: - uses: actions/checkout@v2 - uses: actions/setup-go@v5 diff --git a/.github/workflows/ci-style-checks.yml b/.github/workflows/ci-style-checks.yml index b6cda4f78..739db73a3 100644 --- a/.github/workflows/ci-style-checks.yml +++ b/.github/workflows/ci-style-checks.yml @@ -11,10 +11,10 @@ jobs: style-check: runs-on: ubuntu-latest steps: - - name: Set up Go 1.26.4 + - name: Set up Go 1.26.7 uses: actions/setup-go@v5 with: - go-version: 1.26.4 + go-version: 1.26.7 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-trivy.yml b/.github/workflows/ci-trivy.yml index 8e37e8b3b..d84e3629e 100644 --- a/.github/workflows/ci-trivy.yml +++ b/.github/workflows/ci-trivy.yml @@ -12,10 +12,10 @@ jobs: scan-vulnerabilities: runs-on: ubuntu-latest steps: - - name: Set up Go 1.26.4 + - name: Set up Go 1.26.7 uses: actions/setup-go@v1 with: - go-version: 1.26.4 + go-version: 1.26.7 id: go - name: Check out code into the Go module directory diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5bb486a05..6502a6a06 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v4 with: - go-version: '1.26.4' + go-version: '1.26.7' - name: Get the version id: get_version diff --git a/go.mod b/go.mod index 830eaa050..68a9cc3bd 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/streamnative/pulsarctl -go 1.26.4 +go 1.26.7 require ( github.com/apache/pulsar-client-go v0.18.0-candidate-1.0.20251222030102-3bb7d4eff361 @@ -93,7 +93,7 @@ require ( golang.org/x/mod v0.31.0 // indirect golang.org/x/net v0.48.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect - golang.org/x/sys v0.39.0 // indirect + golang.org/x/sys v0.44.0 // indirect golang.org/x/text v0.32.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect diff --git a/go.sum b/go.sum index 91c0b6e48..73d29d0e0 100644 --- a/go.sum +++ b/go.sum @@ -285,8 +285,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= -golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= +golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q= golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= From cadd08b2c645e70f73f1a1e2f69775e32a15ee73 Mon Sep 17 00:00:00 2001 From: Matteo Merli Date: Wed, 19 Aug 2026 17:38:18 -0700 Subject: [PATCH 2/3] fix: bump golangci-lint to v2.13.0 for Go 1.26 compatibility style-check on this branch has been latently broken since #2095 moved the go directive to the 1.26 line: the pinned golangci-lint v2.7.2 is built with Go 1.25 and refuses to load a config targeting a newer language version ("the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version"). No PR had exercised the workflow on this branch since then, so the Go 1.26.7 bump surfaced it rather than caused it. v2.13.0 is the current release, built with Go 1.26. master and branch-4.2 stay on v2.7.2, which works there because their go directives are on the 1.25 line. --- .github/workflows/ci-style-checks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-style-checks.yml b/.github/workflows/ci-style-checks.yml index 739db73a3..660af8ae6 100644 --- a/.github/workflows/ci-style-checks.yml +++ b/.github/workflows/ci-style-checks.yml @@ -21,7 +21,7 @@ jobs: - name: golangci-lint uses: golangci/golangci-lint-action@v9 with: - version: v2.7.2 + version: v2.13.0 args: --timeout=10m -v - name: Build run: go build . From fe28a7441a48332401c663086779f70ad4ee4d01 Mon Sep 17 00:00:00 2001 From: Matteo Merli Date: Wed, 19 Aug 2026 17:47:08 -0700 Subject: [PATCH 3/3] fix: upgrade setup-go to v5 in ci-trivy workflow scan-vulnerabilities on this branch still used actions/setup-go@v1, which dies silently under the Node 24 runtime GitHub now forces on runners. master and branch-4.2 already use @v5 in the same workflow; this brings branch-4.0 in line. Like the golangci-lint pin, this was latent breakage surfaced by the first PR to exercise this branch's CI since June, not caused by the Go upgrade itself. release.yml stays on @v4, which works; only the broken @v1 is touched. --- .github/workflows/ci-trivy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-trivy.yml b/.github/workflows/ci-trivy.yml index d84e3629e..b282fee1c 100644 --- a/.github/workflows/ci-trivy.yml +++ b/.github/workflows/ci-trivy.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Set up Go 1.26.7 - uses: actions/setup-go@v1 + uses: actions/setup-go@v5 with: go-version: 1.26.7 id: go