Skip to content

Commit fdfe439

Browse files
nsinglansingla
committed
fix(deps): bump Go dependencies to resolve critical CVEs [rhoai-3.3]
Update vulnerable dependencies: - golang.org/x/crypto: v0.36.0 → v0.52.0 - golang.org/x/net: v0.38.0 → v0.55.0 - github.com/go-jose/go-jose/v3: v3.0.4 → v3.0.5 - google.golang.org/grpc: v1.71.1 → v1.79.3 CVEs resolved (combined with cherry-picked Argo fixes): - CVE-2026-42508 (x/crypto ssh/knownhosts revocation bypass, CVSS 9.1) - CVE-2026-33186 (gRPC-Go auth bypass, CVSS 9.1) - CVE-2026-42294 (Argo Workflows webhook DoS, CVSS 8.2) - CVE-2026-42296 (Argo Workflows templateReferencing bypass, CVSS 8.1) - CVE-2026-39828 (x/crypto ssh unauthorized command execution) - CVE-2026-39829 (x/crypto ssh DoS via crafted public key) - CVE-2026-39830 (x/crypto ssh DoS via resource leak) - CVE-2026-39831 (x/crypto ssh missing user presence check) - CVE-2026-39832 (x/crypto ssh/agent key restriction bypass) - CVE-2026-25681 (x/net/html XSS) - CVE-2026-34986 (go-jose DoS via crafted JWE) - CVE-2026-32286 (pgproto3/v2 DoS — transitive, no v2 fix available) - CVE-2026-4427 (pgproto3/v2 DoS — duplicate of CVE-2026-32286) Jira tickets: RHOAIENG-71707, RHOAIENG-71708, RHOAIENG-71685, RHOAIENG-71686, RHOAIENG-70952, RHOAIENG-70953, RHOAIENG-70909, RHOAIENG-70911, RHOAIENG-70740, RHOAIENG-70744, RHOAIENG-70520, RHOAIENG-70523, RHOAIENG-70057, RHOAIENG-70061, RHOAIENG-69763, RHOAIENG-69765, RHOAIENG-69708, RHOAIENG-69718, RHOAIENG-69539, RHOAIENG-56825, RHOAIENG-56826, RHOAIENG-55771, RHOAIENG-55772, RHOAIENG-55302, RHOAIENG-55303, RHOAIENG-54317, RHOAIENG-54318 Signed-off-by: Nelesh Singla <117123879+nsingla@users.noreply.github.com>
1 parent 14d444f commit fdfe439

10 files changed

Lines changed: 792 additions & 1430 deletions

File tree

‎.github/workflows/ci-build.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ jobs:
132132
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
133133
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
134134
with:
135-
go-version: "1.24"
135+
go-version: "1.25"
136136
cache: true
137137
- run: make test STATIC_FILES=false GOTEST='go test -p 20 -covermode=atomic -coverprofile=coverage.out'
138138
- name: Upload coverage report
@@ -154,7 +154,7 @@ jobs:
154154
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
155155
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
156156
with:
157-
go-version: "1.24"
157+
go-version: "1.25"
158158
cache: true
159159
# windows run does not use makefile target because it does a lot more than just testing and is not cross-platform compatible
160160
- run: go test -p 20 -covermode=atomic -coverprofile='coverage.out' $(go list ./... | select-string -Pattern 'github.com/argoproj/argo-workflows/v3/workflow/controller' , 'github.com/argoproj/argo-workflows/v3/server' -NotMatch)
@@ -270,7 +270,7 @@ jobs:
270270
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
271271
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
272272
with:
273-
go-version: "1.24"
273+
go-version: "1.25"
274274
cache: true
275275
- name: Install Java for the SDK
276276
if: ${{matrix.test == 'test-java-sdk'}}
@@ -409,7 +409,7 @@ jobs:
409409
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
410410
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
411411
with:
412-
go-version: "1.24"
412+
go-version: "1.25"
413413
cache: true
414414
- name: Install protoc
415415
run: |
@@ -446,7 +446,7 @@ jobs:
446446
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
447447
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
448448
with:
449-
go-version: "1.24"
449+
go-version: "1.25"
450450
cache: true
451451
- run: make lint STATIC_FILES=false
452452
# if lint makes changes that are not in the PR, fail the build

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ ARG GIT_COMMIT=unknown
33
ARG GIT_TAG=unknown
44
ARG GIT_TREE_STATE=unknown
55

6-
FROM golang:1.24.4-alpine3.22 as builder
6+
FROM golang:1.25.0-alpine3.22 as builder
77

88
# libc-dev to build openapi-gen
99
RUN apk update && apk add --no-cache \

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -356,7 +356,7 @@ endif
356356
$(GOPATH)/bin/swagger: Makefile
357357
# update this in Nix when upgrading it here
358358
ifneq ($(USE_NIX), true)
359-
go install github.com/go-swagger/go-swagger/cmd/swagger@v0.31.0
359+
go install github.com/go-swagger/go-swagger/cmd/swagger@v0.35.0
360360
endif
361361
$(GOPATH)/bin/goimports: Makefile
362362
# update this in Nix when upgrading it here
@@ -462,7 +462,7 @@ dist/manifests/%: manifests/%
462462
# lint/test/etc
463463

464464
$(GOPATH)/bin/golangci-lint: Makefile
465-
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b `go env GOPATH`/bin v2.1.1
465+
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.12.2/install.sh | sh -s -- -b `go env GOPATH`/bin v2.12.2
466466

467467
.PHONY: lint
468468
lint: server/static/files.go $(GOPATH)/bin/golangci-lint

‎docs/executor_swagger.md‎

Lines changed: 387 additions & 444 deletions
Large diffs are not rendered by default.

‎go.mod‎

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/argoproj/argo-workflows/v3
22

3-
go 1.24.4
3+
go 1.25.0
44

55
require (
66
cloud.google.com/go/storage v1.50.0
@@ -22,7 +22,7 @@ require (
2222
github.com/expr-lang/expr v1.17.7
2323
github.com/gavv/httpexpect/v2 v2.16.0
2424
github.com/go-git/go-git/v5 v5.14.0
25-
github.com/go-jose/go-jose/v3 v3.0.4
25+
github.com/go-jose/go-jose/v3 v3.0.5
2626
github.com/go-openapi/jsonreference v0.21.0
2727
github.com/go-sql-driver/mysql v1.7.1
2828
github.com/gogo/protobuf v1.3.2
@@ -47,26 +47,26 @@ require (
4747
github.com/spf13/cobra v1.9.1
4848
github.com/spf13/pflag v1.0.6
4949
github.com/spf13/viper v1.20.0
50-
github.com/stretchr/testify v1.10.0
50+
github.com/stretchr/testify v1.11.1
5151
github.com/tidwall/gjson v1.18.0
5252
github.com/upper/db/v4 v4.7.0
5353
github.com/valyala/fasttemplate v1.2.2
5454
github.com/xeipuuv/gojsonschema v1.2.0
5555
go.opentelemetry.io/contrib/instrumentation/runtime v0.48.0
56-
go.opentelemetry.io/otel v1.34.0
56+
go.opentelemetry.io/otel v1.39.0
5757
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.23.0
5858
go.opentelemetry.io/otel/exporters/prometheus v0.45.1
59-
go.opentelemetry.io/otel/metric v1.34.0
60-
go.opentelemetry.io/otel/sdk v1.34.0
61-
go.opentelemetry.io/otel/sdk/metric v1.34.0
62-
golang.org/x/crypto v0.36.0
59+
go.opentelemetry.io/otel/metric v1.39.0
60+
go.opentelemetry.io/otel/sdk v1.39.0
61+
go.opentelemetry.io/otel/sdk/metric v1.39.0
62+
golang.org/x/crypto v0.52.0
6363
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
64-
golang.org/x/oauth2 v0.28.0
65-
golang.org/x/sync v0.12.0
64+
golang.org/x/oauth2 v0.34.0
65+
golang.org/x/sync v0.20.0
6666
golang.org/x/time v0.11.0
6767
google.golang.org/api v0.228.0
68-
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb
69-
google.golang.org/grpc v1.71.1
68+
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217
69+
google.golang.org/grpc v1.79.3
7070
gopkg.in/go-playground/webhooks.v5 v5.17.0
7171
k8s.io/api v0.32.2
7272
k8s.io/apimachinery v0.32.2
@@ -82,12 +82,12 @@ require (
8282
)
8383

8484
require (
85-
cel.dev/expr v0.19.2 // indirect
85+
cel.dev/expr v0.25.1 // indirect
8686
cloud.google.com/go/auth v0.15.0 // indirect
8787
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
8888
cloud.google.com/go/monitoring v1.24.0 // indirect
8989
dario.cat/mergo v1.0.1 // indirect
90-
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 // indirect
90+
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
9191
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.50.0 // indirect
9292
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.50.0 // indirect
9393
github.com/TylerBrock/colorjson v0.0.0-20200706003622-8a50f05110d2 // indirect
@@ -97,24 +97,25 @@ require (
9797
github.com/blang/semver/v4 v4.0.0 // indirect
9898
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
9999
github.com/cloudflare/circl v1.6.0 // indirect
100-
github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 // indirect
100+
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
101101
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
102102
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
103103
github.com/distribution/reference v0.6.0 // indirect
104-
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
105-
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
104+
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
105+
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
106106
github.com/evilmonkeyinc/jsonpath v0.8.1 // indirect
107107
github.com/fatih/color v1.18.0 // indirect
108108
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
109109
github.com/go-ini/ini v1.67.0 // indirect
110+
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
110111
github.com/go-logr/stdr v1.2.2 // indirect
111112
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
112113
github.com/gobwas/glob v0.2.4-0.20181002190808-e7a84e9525fe // indirect
113114
github.com/goccy/go-json v0.10.5 // indirect
114115
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
115116
github.com/google/gnostic-models v0.6.9 // indirect
116117
github.com/google/s2a-go v0.1.9 // indirect
117-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
118+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
118119
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
119120
github.com/jackc/pgconn v1.14.3 // indirect
120121
github.com/jackc/pgio v1.0.0 // indirect
@@ -134,23 +135,24 @@ require (
134135
github.com/pjbgf/sha1cd v0.3.2 // indirect
135136
github.com/pkg/errors v0.9.1 // indirect
136137
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
137-
github.com/prometheus/client_model v0.6.1 // indirect
138+
github.com/prometheus/client_model v0.6.2 // indirect
138139
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
139140
github.com/sagikazarmark/locafero v0.7.0 // indirect
140141
github.com/segmentio/fasthash v1.0.3 // indirect
141142
github.com/skeema/knownhosts v1.3.1 // indirect
142143
github.com/sourcegraph/conc v0.3.0 // indirect
144+
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
143145
github.com/vbatts/tar-split v0.11.3 // indirect
144146
github.com/x448/float16 v0.8.4 // indirect
145-
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
146-
go.opentelemetry.io/contrib/detectors/gcp v1.34.0 // indirect
147+
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
148+
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
147149
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 // indirect
148150
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
149-
go.opentelemetry.io/otel/trace v1.34.0 // indirect
150-
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
151+
go.opentelemetry.io/otel/trace v1.39.0 // indirect
152+
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
151153
go.uber.org/multierr v1.11.0 // indirect
152154
google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
153-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
155+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
154156
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
155157
modernc.org/libc v1.41.0 // indirect
156158
modernc.org/mathutil v1.6.0 // indirect
@@ -162,7 +164,7 @@ require (
162164

163165
require (
164166
cloud.google.com/go v0.119.0 // indirect
165-
cloud.google.com/go/compute/metadata v0.6.0 // indirect
167+
cloud.google.com/go/compute/metadata v0.9.0 // indirect
166168
cloud.google.com/go/iam v1.4.1 // indirect
167169
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
168170
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0
@@ -221,7 +223,7 @@ require (
221223
github.com/go-errors/errors v1.4.2 // indirect
222224
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
223225
github.com/go-git/go-billy/v5 v5.6.2 // indirect
224-
github.com/go-logr/logr v1.4.2 // indirect
226+
github.com/go-logr/logr v1.4.3 // indirect
225227
github.com/go-openapi/jsonpointer v0.21.0 // indirect
226228
github.com/go-openapi/swag v0.23.0 // indirect
227229
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
@@ -296,11 +298,11 @@ require (
296298
github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0 // indirect
297299
github.com/yudai/gojsondiff v1.0.0 // indirect
298300
github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect
299-
golang.org/x/net v0.38.0
300-
golang.org/x/sys v0.31.0
301-
golang.org/x/term v0.30.0
302-
golang.org/x/text v0.23.0 // indirect
303-
google.golang.org/protobuf v1.36.6 // indirect
301+
golang.org/x/net v0.55.0
302+
golang.org/x/sys v0.45.0
303+
golang.org/x/term v0.43.0
304+
golang.org/x/text v0.37.0 // indirect
305+
google.golang.org/protobuf v1.36.10 // indirect
304306
gopkg.in/inf.v0 v0.9.1 // indirect
305307
gopkg.in/ini.v1 v1.67.0 // indirect
306308
gopkg.in/warnings.v0 v0.1.2 // indirect

0 commit comments

Comments
 (0)