From ace19d3d4583f30f6b1ec21f089f8fc1c54656bf Mon Sep 17 00:00:00 2001 From: Matteo Merli Date: Wed, 19 Aug 2026 17:28:50 -0700 Subject: [PATCH] fix: upgrade Go to 1.25.14 and x/sys to 0.44.0 for CVEs Backport of the fix on master to branch-4.2. Eight of the findings are Go stdlib (CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862) and come from the toolchain the binary is built with, so every go-version pin moves from 1.25.11 to 1.25.14 along with the go directive. The fix landed in 1.25.13; staying on the 1.25 line this branch already uses avoids a language version jump. The ninth is CVE-2026-39824, an integer overflow in NewNTUnicodeString, fixed by x/sys 0.39.0 -> 0.44.0. Builds clean. go vet reports the same pre-existing finding in pkg/test/pulsar/standalone_test.go as master, unrelated to these upgrades. --- .github/workflows/ci-bookie-checks.yml | 2 +- .github/workflows/ci-functions-checks.yml | 6 +++--- .github/workflows/ci-packages-checks.yml | 2 +- .github/workflows/ci-release-checks.yml | 2 +- .github/workflows/ci-style-checks.yml | 2 +- .github/workflows/ci-trivy.yml | 4 ++-- go.mod | 4 ++-- go.sum | 4 ++-- 8 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci-bookie-checks.yml b/.github/workflows/ci-bookie-checks.yml index 7ac933c57..483f54ab4 100644 --- a/.github/workflows/ci-bookie-checks.yml +++ b/.github/workflows/ci-bookie-checks.yml @@ -14,7 +14,7 @@ jobs: - name: Set up Go 1.25.8 uses: actions/setup-go@v6 with: - go-version: 1.25.11 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-functions-checks.yml b/.github/workflows/ci-functions-checks.yml index 4611709e6..8e5f727c4 100644 --- a/.github/workflows/ci-functions-checks.yml +++ b/.github/workflows/ci-functions-checks.yml @@ -17,7 +17,7 @@ jobs: - name: Set up Go 1.25.8 uses: actions/setup-go@v6 with: - go-version: 1.25.11 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 @@ -37,7 +37,7 @@ jobs: - name: Set up Go 1.25.8 uses: actions/setup-go@v6 with: - go-version: 1.25.11 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 @@ -54,7 +54,7 @@ jobs: - name: Set up Go 1.25.8 uses: actions/setup-go@v6 with: - go-version: 1.25.11 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-packages-checks.yml b/.github/workflows/ci-packages-checks.yml index 9feaad2d4..2bd84591a 100644 --- a/.github/workflows/ci-packages-checks.yml +++ b/.github/workflows/ci-packages-checks.yml @@ -17,7 +17,7 @@ jobs: - name: Set up Go 1.25.8 uses: actions/setup-go@v5 with: - go-version: 1.25.11 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-release-checks.yml b/.github/workflows/ci-release-checks.yml index 2205fe11b..5685e4ceb 100644 --- a/.github/workflows/ci-release-checks.yml +++ b/.github/workflows/ci-release-checks.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - go-version: [ 1.25.11 ] + go-version: [ 1.25.14 ] steps: - uses: actions/checkout@v2 - uses: actions/setup-go@v5 diff --git a/.github/workflows/ci-style-checks.yml b/.github/workflows/ci-style-checks.yml index 28baffacf..efe854bc5 100644 --- a/.github/workflows/ci-style-checks.yml +++ b/.github/workflows/ci-style-checks.yml @@ -14,7 +14,7 @@ jobs: - name: Set up Go 1.25.8 uses: actions/setup-go@v5 with: - go-version: 1.25.11 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory uses: actions/checkout@v2 diff --git a/.github/workflows/ci-trivy.yml b/.github/workflows/ci-trivy.yml index 11617313d..7010874a7 100644 --- a/.github/workflows/ci-trivy.yml +++ b/.github/workflows/ci-trivy.yml @@ -12,10 +12,10 @@ jobs: scan-vulnerabilities: runs-on: ubuntu-latest steps: - - name: Set up Go 1.25.11 + - name: Set up Go 1.25.14 uses: actions/setup-go@v5 with: - go-version: 1.25.11 + go-version: 1.25.14 id: go - name: Check out code into the Go module directory diff --git a/go.mod b/go.mod index 920132325..ec7e36aa5 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/streamnative/pulsarctl -go 1.25.11 +go 1.25.14 require ( github.com/apache/pulsar-client-go v0.18.0-candidate-1.0.20251222030102-3bb7d4eff361 @@ -93,7 +93,7 @@ require ( golang.org/x/mod v0.31.0 // indirect golang.org/x/net v0.48.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect - golang.org/x/sys v0.39.0 // indirect + golang.org/x/sys v0.44.0 // indirect golang.org/x/text v0.32.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect diff --git a/go.sum b/go.sum index 91c0b6e48..73d29d0e0 100644 --- a/go.sum +++ b/go.sum @@ -285,8 +285,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= -golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= +golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q= golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=