Uplift Go to 1.26.6 and bump vulnerable dependencies - #620
Open
bszirtes wants to merge 3 commits into
Open
Conversation
Address the following CVEs/advisories: - CVE-2026-56852: golang.org/x/text v0.32.0 -> v0.39.0 - CVE-2026-46600: golang.org/x/net v0.48.0 -> v0.56.0 - GHSA-hrxh-6v49-42gf: google.golang.org/grpc v1.79.3 -> v1.82.1 - CVE-2026-39824: golang.org/x/sys v0.42.0 -> v0.47.0 Also bump go directive from 1.25.9 to 1.26.6 in both modules, and update golang:1.25 base images to golang:1.26 in all Dockerfiles so container builds satisfy the new module Go version requirement. Transitively upgraded: golang.org/x/oauth2, golang.org/x/sync, golang.org/x/term, golang.org/x/tools, google.golang.org/protobuf, google.golang.org/genproto/googleapis/api and .../rpc. Verified with go build, go vet, go mod verify, and the unit test suite (go test -race -cover -short ./...) using go1.26.6. Signed-off-by: Botond Szirtes <botond.szirtes@est.tech>
The Makefile pinned golangci-lint@v1.62.2, which predates Go 1.26 support and cannot lint the module after the Go 1.26.6 uplift. Migrate .golangci.yml to the v2 config format and repin the tool to v2.13.2 (module path moved to .../golangci-lint/v2/cmd/golangci-lint in the 2.x line). The staticcheck settings restrict checks to SA* and S* groups to replicate the previously separate gosimple linter, which v2 folded into staticcheck. Also fix a real finding (SA4023) surfaced by the newer staticcheck in cmd/operator/main.go: WatchX509Context only returns once its internal retry loop gives up, so the returned error is never nil, making the err != nil check dead logic. Verified with go build, go vet, go test -short ./..., and make lint using go1.26.6. Signed-off-by: Botond Szirtes <botond.szirtes@est.tech>
Transitively upgrades github.com/prometheus/client_golang (1.21.1 -> 1.23.2), client_model (0.6.1 -> 0.6.2), common (0.62.0 -> 0.67.4) and procfs (0.15.1 -> 0.19.2). Verified with go build, go vet, go test -short ./..., and make lint. Signed-off-by: Botond Szirtes <botond.szirtes@est.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses the following security advisories by uplifting Go and affected dependencies:
Notes:
.golangci.ymlwas migrated to the v2 config format and the tool repinned to v2.13.2 (module path moved to.../golangci-lint/v2/cmd/golangci-lintin the 2.x line). Thestaticchecksettings restrict checks toSA*/S*to replicate the previously separategosimplelinter, which v2 folded intostaticcheck.cmd/operator/main.go:WatchX509Contextonly returns once its internal retry loop gives up, so the returned error is never nil, making theerr != nilcheck dead logic. Fixed and documented.go.opentelemetry.io/otel/exporters/prometheusfrom v0.52.0 to v0.61.0, transitively upgradinggithub.com/prometheus/client_golang(v1.21.1 -> v1.23.2),client_model(v0.6.1 -> v0.6.2),common(v0.62.0 -> v0.67.4) andprocfs(v0.15.1 -> v0.19.2). No code changes required.Testing
go build ./...— passes in both modulesgo vet ./...— passes in both modulesgo mod tidy/go mod verify— cleango test -race -cover -short -count=1 ./...— all unit tests passmake lint(golangci-lint v2.13.2) — 0 issuesE2E/local deployment tests were not run as part of this change.