Bump Go toolchain to 1.25.11 to resolve std-lib security vulnerabilities - #153
Open
shayanshafii wants to merge 2 commits into
Open
shayanshafii wants to merge 2 commits into
shayanshafii wants to merge 2 commits into
Conversation
Snyk flagged the Go standard library at 1.23.7 with 10 HIGH-severity vulns in std/crypto/x509, std/mime, std/net, std/net/http, and std/net/url. Bumping the go directive to 1.25.11 (the smallest patch that clears all reported HIGHs) builds against a patched std lib. Also bump golangci-lint to v2.5.0 (built with go1.25) so the linter supports the new language version, and pin the lint workflow's Go to go.mod. Co-Authored-By: shayan <shayan@cognition.ai>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Co-Authored-By: shayan <shayan@cognition.ai>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A Snyk SCA scan flagged the Go standard library (built at
go 1.23.7) with 10 HIGH-severity vulnerabilities. These are fixed by building against a patched Go toolchain. This PR bumps thegodirective — and the matching CI/Docker Go pins — to 1.25.11, the smallest stable patch that clears every reported HIGH.Why 1.25.11 (not 1.24.x or latest 1.26.x)
The 1.24 line is EOL for these CVEs —
std/mime,std/net,std/net/httpfixes were not backported, so 1.24.x cannot clear all HIGHs. 1.25.11 is the lowest patch where every reported HIGH is fixed (per the Snyk fix versions below), so it's the smallest viable bump.HIGHs resolved (all in the Go std lib)
std/crypto/x509std/mimestd/netstd/net/httpstd/net/urlCI / lint change
golangci-lint v2.1 is built with go1.24 and hard-fails to load any module whose language version is ≥ 1.25 (
config load error, not findings). So.github/workflows/lint.ymlis updated to:golangci-lintv2.1→v2.5.0(built with go1.25, supports the 1.25 language version)go-version: stable→go-version-file: "go.mod", matching every other workflow so the lint job tracks go.mod.The other workflows (
go.yml,license-check.yml,docs-check.yml,goreleaser.yml) already usego-version-file: "go.mod", andcode-scanning.ymlresolves the version from the environment, so they pick up 1.25.11 automatically. No Dockerfile multi-stage or distroless runtime change needed beyond the build image.Verification
Local, with the go1.25.11 toolchain:
go build ./...— passgo test ./...— passgolangci-lint run(v2.5.0) —0 issuesSnyk
npx snyk test --all-projects(go.modstd-lib version drives the std findings):go 1.23.7)go 1.25.11)All 10 std-lib HIGHs are resolved. The single remaining Medium is in the third-party dependency
github.com/go-viper/mapstructure/v2(log-injection) — unrelated to the Go toolchain and out of scope for this change.Tradeoffs
go.sumchanges (module graph pruning is identical for ≥1.17 modules).v2.5.0rather than latest (v2.12.x); newer golangci-lint adds new gosec/staticcheck/govet rules that would surface unrelated findings, so the oldest go1.25-compatible release keeps this PR focused on the security bump.Link to Devin session: https://app.devin.ai/sessions/737542c0b74f418cb2042a646f39a83b
Requested by: @shayanshafii
Devin Review