fix: update Go version to 1.25.7 to address critical security vulnerabilities#7472
Conversation
…bilities This updates the Go version from 1.25.0 to 1.25.7 to fix the following critical and high severity vulnerabilities in the Go standard library: CRITICAL: - CVE-2025-68121: crypto/tls: Unexpected session resumption in crypto/tls - CVE-2024-24790: net/netip: Unexpected behavior from Is methods - CVE-2024-45337: golang.org/x/crypto/ssh: Authorization bypass HIGH: - CVE-2025-61726: net/url: Memory exhaustion in query parameter parsing - CVE-2025-61728: archive/zip: Excessive CPU consumption - CVE-2025-61729: crypto/x509: Denial of Service - CVE-2025-61730: TLS 1.3 handshake vulnerability - CVE-2025-30204: golang-jwt/jwt: Memory allocation during header parsing - CVE-2025-22868: golang.org/x/oauth2/jws: Memory consumption - CVE-2025-22869: golang.org/x/crypto/ssh: DoS in Key Exchange Signed-off-by: WSandboxedOCCodeBot <bot@openclaw.dev>
|
Thank you for your contribution! 🙏 Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected. While you are waiting, make sure to:
Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient. Learn more about our contribution guide. |
|
| Status | Scanner |  Critical |
 High |
 Medium |
 Low |
Total (0) |
|---|---|---|---|---|---|---|
| Open Source Security | 0 | 0 | 0 | 0 | See details |
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
JorTurFer
left a comment
JorTurFer
left a comment
There was a problem hiding this comment.
we don't set the latest version here but in docker images. As go.mod just sets the minimum version, we can keep this "free" for any 1.25 and enforce it during docker generation
|
in any case, thanks for the report, I can prepate a PR later on for this if you want. The idea is to modify docker tags for image generation (dockerfiles) as well as the tag used for gh actions containers. The image 1.25.7 is in building process -> https://github.com/kedacore/test-tools/actions/runs/22284693777/job/64460881884 |
2 participants
Summary
This updates the Go version from 1.25.0 to 1.25.7 to fix the following critical and high severity vulnerabilities in the Go standard library:
CRITICAL:
HIGH:
Vulnerability Scan Results
Trivy scan of
ghcr.io/kedacore/keda:2.12.0found 3 CRITICAL and 19 HIGH vulnerabilities that are fixed by updating to Go 1.25.7.Testing
Signed-off-by: WSandboxedOCCodeBot bot@openclaw.dev