Repository navigation
fix(security): bump Go to 1.26.5 and aws-sdk s3 to v1.97.3 (GO-2026-5856, GO-2026-5764) - #1359
Conversation
…856, GO-2026-5764)
Clear two govulncheck CVEs:
GO-2026-5856 (crypto/tls ECH privacy leak): the minimum patched Go
toolchain per govulncheck is 1.26.5. Bump the `go` directive in all
five go.mod files (root, pkg, providers/{aws,azure,gcp}) from 1.25.x
to 1.26.5, update the CI GO_VERSION env var, and switch builder stages
in Dockerfile / Dockerfile.test / Dockerfile.dev from
golang:1.25.4-alpine3.21 to golang:1.26.5-alpine3.24 (SHA pinned).
GO-2026-5764 (DoS via EventStream panic in aws/protocol/eventstream):
fixed in github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3. Bump s3 via
`go get` in the root module; go mod tidy also pulls compatible updates
for the five related aws-sdk-go-v2 packages that track the s3 version
(internal/v4a, service/internal/{accept-encoding,checksum,
presigned-url,s3shared}).
Verified: govulncheck ./... reports "No vulnerabilities found" in all
five modules with GOTOOLCHAIN=go1.26.5. go build ./... and
go test -short ./... (5546 tests) both exit 0.
cristim
added
triaged
|
@coderabbitai review |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (10)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
✅ Action performedReview finished.
|
fix(security): bump Go to 1.26.5 and aws-sdk s3 to v1.97.3 (GO-2026-5856, GO-2026-5764)
Summary
github.com/aws/aws-sdk-go-v2/service/s3from v1.93.0 to v1.97.3 in the root go.mod; five related aws-sdk-go-v2 packages also updated by go mod tidy.What changed
go.modgo 1.25.0 toolchain go1.25.5->go 1.26.5;s3 v1.93.0->v1.97.3+ 5 related s3 dep bumpspkg/go.modproviders/{aws,azure,gcp}/go.modgo 1.25.0->go 1.26.5.github/workflows/ci.ymlGO_VERSION: '1.25'->'1.26.5'.github/workflows/pre-commit.ymlgo-version: "1.25.4"->"1.26.5"Dockerfile/Dockerfile.testgolang:1.25.4-alpine3.21->golang:1.26.5-alpine3.24(SHA pinned)Dockerfile.devgolang:1.25.4-alpine3.21->golang:1.26.5-alpine3.24Note: the task description estimated the fix version as Go 1.25.12, but govulncheck v1.1.4 (the pinned version in CI) reports
Fixed in: crypto/tls@go1.26.5, so 1.26.5 is the correct minimum patched version.Verification
GOTOOLCHAIN=go1.26.5 govulncheck ./...on root module: No vulnerabilities found (exit 0)GOTOOLCHAIN=go1.26.5 go build ./...: exit 0GOTOOLCHAIN=go1.26.5 go test -short ./...: 5546 tests passed, exit 0 (integration tests need Docker/PostgreSQL and were correctly skipped via-short)Test plan
golang:1.26.5-alpine3.24