Update Go to 1.24 and upgrade all dependencies#282
Merged
prudhvigodithi merged 4 commits intoopensearch-project:mainfrom Feb 10, 2026
Merged
Update Go to 1.24 and upgrade all dependencies#282prudhvigodithi merged 4 commits intoopensearch-project:mainfrom
prudhvigodithi merged 4 commits intoopensearch-project:mainfrom
Conversation
- Bump Go version from 1.22.12 to 1.24 - Update golang.org/x/crypto to v0.47.0 (remediates CVE-2025-22869) - Update golang.org/x/net to v0.49.0 (remediates CVE-2025-22870) - Update all other Go dependencies to latest compatible versions - Update CI workflow Go version from 1.22.1 to 1.24 Resolves opensearch-project#258 Supersedes opensearch-project#275 Signed-off-by: Gong-Guard <gong-guard@gong.dev>
danielrubin1989
requested review from
jackson-theisen,
peterzhuamazon,
phillbaker,
prudhvigodithi and
rblcoder
as code owners
added 3 commits
February 9, 2026 11:13
- Bump golangci-lint Go version from 1.22.1 to 1.24 - Exclude SA1019 deprecation warnings for aws-sdk-go v1 (migration to v2 is a separate effort, tracked upstream) - Exclude pre-existing govet printf warnings in resource_opensearch_user.go (non-constant format strings using string concatenation) Signed-off-by: Gong-Guard <gong-guard@gong.dev>
Replace string concatenation in log.Printf calls with format verbs. Go 1.24 treats non-constant format strings as a build error via govet. - Line 143: use %s format verb for path - Line 158: use %s format verb for response body - Line 159: use %d format verb for status code Signed-off-by: Gong-Guard <gong-guard@gong.dev>
The underlying code was fixed in the previous commit, so the lint exclusion is no longer needed. Signed-off-by: Gong-Guard <gong-guard@gong.dev>
Member
|
Thanks @danielrubin1989 overal LGTM. |
prudhvigodithi
approved these changes
Feb 10, 2026
github-project-automation
bot
moved this to 👀 In Review
in Engineering Effectiveness Board
github-project-automation
bot
moved this from 👀 In Review
to ✅ Done
in Engineering Effectiveness Board
Contributor
Author
|
@prudhvigodithi Thanks for merging! Is there a planned timeline for the next release that would include these dependency updates and the security fixes for CVE-2025-22869 and CVE-2025-22870? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR updates the Go version from 1.22.12 to 1.24 and upgrades all Go dependencies to their latest compatible versions.
Security Fixes
golang.org/x/cryptov0.32.0 → v0.47.0 — remediates CVE-2025-22869 (CVSS 7.5)golang.org/x/netv0.34.0 → v0.49.0 — remediates CVE-2025-22870 (CVSS 4.4)Other Dependency Updates
github.com/aws/aws-sdk-gov1.52.2 → v1.55.8github.com/hashicorp/terraform-plugin-sdk/v2v2.36.0 → v2.38.2github.com/hashicorp/terraform-plugin-gov0.26.0 → v0.29.0github.com/hashicorp/go-pluginv1.6.2 → v1.7.0github.com/hashicorp/hcl/v2v2.23.0 → v2.24.0google.golang.org/grpcv1.69.4 → v1.78.0google.golang.org/protobufv1.36.3 → v1.36.11golang.org/x/*packages updated to latestCI Changes
.github/workflows/test.ymlfrom 1.22.1 to 1.24 (lint, test matrix, and release jobs)Issues Resolved
Resolves #258
Supersedes #275 (which only updated
golang.org/x/*packages — this PR is a superset that updates all dependencies)Testing
go build ./...— passesgo mod verify— passesgo mod tidy— clean (no additional changes)Check List
--signoff.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.