Skip to content

Conversation

@kalleep
Copy link
Contributor

@kalleep kalleep commented Jan 19, 2026

Update to latest go version includes bug fixes and security fixes for:

  • CVE-2025-68121
  • CVE-2025-61728
  • CVE-2025-61726
  • CVE-2025-61731
  • CVE-2025-68119

@kalleep kalleep requested a review from a team as a code owner January 19, 2026 09:30
@github-actions
Copy link
Contributor

github-actions bot commented Jan 19, 2026

🔍 Dependency Review

No third-party module versions changed in any go.mod. The only change in go.mod files is a patch bump of the Go toolchain version from 1.25.5 to 1.25.6 across multiple modules. Patch releases of Go are limited to bug and security fixes and do not include language or standard library API changes.

Below is the assessment for the Go version bump.

Go toolchain go 1.25.5 -> 1.25.6 — ✅ Safe
  • Scope of change:

    • go directive updated in:
      • ./go.mod
      • ./collector/go.mod
      • ./extension/alloyengine/go.mod
      • ./syntax/go.mod
  • Expected impact:

    • Per Go’s release policy, patch releases only include bug and security fixes and do not change language semantics or public stdlib APIs.
    • No code changes are required to adopt a patch-level Go update.
  • References:

  • Code changes required: None.

Notes

  • Non-go.mod changes (CI workflow build images and Docker base images) were updated to corresponding 1.25.6-compatible images. These are outside the scope of this review per the instructions.

@kalleep kalleep merged commit 1c5966d into main Jan 19, 2026
55 of 56 checks passed
@kalleep kalleep deleted the kalleep/update-go-v1.25.6 branch January 19, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants