From a840ed1d44d35353e1f7b9b0f2960dfbf0fa2138 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 10 Jul 2026 13:11:41 +0200 Subject: [PATCH] fix(security): bump Go to 1.26.5 and aws-sdk s3 to v1.97.3 (GO-2026-5856, GO-2026-5764) Clear two govulncheck CVEs: GO-2026-5856 (crypto/tls ECH privacy leak): the minimum patched Go toolchain per govulncheck is 1.26.5. Bump the `go` directive in all five go.mod files (root, pkg, providers/{aws,azure,gcp}) from 1.25.x to 1.26.5, update the CI GO_VERSION env var, and switch builder stages in Dockerfile / Dockerfile.test / Dockerfile.dev from golang:1.25.4-alpine3.21 to golang:1.26.5-alpine3.24 (SHA pinned). GO-2026-5764 (DoS via EventStream panic in aws/protocol/eventstream): fixed in github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3. Bump s3 via `go get` in the root module; go mod tidy also pulls compatible updates for the five related aws-sdk-go-v2 packages that track the s3 version (internal/v4a, service/internal/{accept-encoding,checksum, presigned-url,s3shared}). Verified: govulncheck ./... reports "No vulnerabilities found" in all five modules with GOTOOLCHAIN=go1.26.5. go build ./... and go test -short ./... (5546 tests) both exit 0. --- .github/workflows/ci.yml | 4 ++-- .github/workflows/pre-commit.yml | 2 +- Dockerfile | 4 ++-- Dockerfile.dev | 4 ++-- Dockerfile.test | 2 +- go.mod | 16 +++++++--------- go.sum | 24 ++++++++++++------------ pkg/go.mod | 2 +- providers/aws/go.mod | 2 +- providers/azure/go.mod | 2 +- providers/gcp/go.mod | 2 +- 11 files changed, 31 insertions(+), 33 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27713cb78..96c9b9720 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ # Required GitHub Secrets: None (all checks run without cloud credentials) # # Required GitHub Variables: -# - GO_VERSION: Go version to use (default: 1.25) +# - GO_VERSION: Go version to use (default: 1.26.5) # # Triggered by: # - Pull requests to main/develop @@ -23,7 +23,7 @@ on: workflow_dispatch: env: - GO_VERSION: '1.25' + GO_VERSION: '1.26.5' DOCKER_BUILDKIT: 1 COMPOSE_DOCKER_CLI_BUILD: 1 diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index df799778a..fc31534d0 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -32,7 +32,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.25.4" + go-version: "1.26.5" - name: Set up Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/Dockerfile b/Dockerfile index 7ad8edbba..f58a5f08b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,10 +12,10 @@ ARG TARGETOS=linux # Build stage # Image pinned to a SHA256 digest for reproducible builds — a registry # tag mutation (Docker Hub allows re-tagging) cannot poison this build. -# To refresh: `docker buildx imagetools inspect golang:1.25.4-alpine3.21` +# To refresh: `docker buildx imagetools inspect golang:1.26.5-alpine3.24` # (or use the Docker Hub API tags endpoint) and update the digest below. # A Renovate / Dependabot config can automate this if desired. -FROM golang:1.25.4-alpine3.21@sha256:3289aac2aac769e031d644313d094dbda745f28af81cd7a94137e73eefd58b33 AS builder +FROM golang:1.26.5-alpine3.24@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder # Re-declare args for use in this stage ARG TARGETARCH diff --git a/Dockerfile.dev b/Dockerfile.dev index f8311696b..df8077b3e 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,7 +1,7 @@ # Development Dockerfile with hot reload using Air # TODO: Pin to SHA256 digest for reproducible builds: -# docker buildx imagetools inspect golang:1.25.4-alpine3.21 -FROM golang:1.25.4-alpine3.21 AS development +# docker buildx imagetools inspect golang:1.26.5-alpine3.24 +FROM golang:1.26.5-alpine3.24 AS development # Install development tools and Air for hot reload RUN apk add --no-cache \ diff --git a/Dockerfile.test b/Dockerfile.test index 0e50a0446..09af056b8 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -5,7 +5,7 @@ # # Base image pinned by digest for the same supply-chain reasons as Dockerfile; # keep the digest in sync with the builder stage there. -FROM golang:1.25.4-alpine3.21@sha256:3289aac2aac769e031d644313d094dbda745f28af81cd7a94137e73eefd58b33 +FROM golang:1.26.5-alpine3.24@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 # Run the suite as a non-root user (trivy DS-0002). tests/e2e is a stdlib-only # module so no module downloads are needed; GOCACHE lives in the user's home, diff --git a/go.mod b/go.mod index f308e0402..56e8cadd0 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,6 @@ module github.com/LeanerCloud/CUDly -go 1.25.0 - -toolchain go1.25.5 +go 1.26.5 require ( github.com/aws/aws-sdk-go-v2 v1.41.5 @@ -41,8 +39,8 @@ require ( github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.15 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect github.com/aws/aws-sdk-go-v2/service/savingsplans v1.31.0 github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 // indirect github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 // indirect @@ -100,7 +98,7 @@ require ( github.com/aws/aws-sdk-go-v2/service/kms v1.50.4 github.com/aws/aws-sdk-go-v2/service/lambda v1.89.0 github.com/aws/aws-sdk-go-v2/service/organizations v1.45.3 - github.com/aws/aws-sdk-go-v2/service/s3 v1.93.0 + github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.40.3 github.com/aws/aws-sdk-go-v2/service/sesv2 v1.42.0 github.com/aws/aws-sdk-go-v2/service/sns v1.34.0 @@ -134,9 +132,9 @@ require ( github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect - github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.15 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.6 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.15 // indirect + github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect diff --git a/go.sum b/go.sum index a25417d6b..9c55d4896 100644 --- a/go.sum +++ b/go.sum @@ -114,8 +114,8 @@ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgq github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps= github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM= github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.15 h1:NLYTEyZmVZo0Qh183sC8nC+ydJXOOeIL/qI/sS3PdLY= -github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.15/go.mod h1:Z803iB3B0bc8oJV8zH2PERLRfQUJ2n2BXISpsA4+O1M= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y= github.com/aws/aws-sdk-go-v2/service/cloudfront v1.58.2 h1:Sm/sQAe/54oCaXj5/xOtMkMvpDafNZhQ38DsyarIBR0= github.com/aws/aws-sdk-go-v2/service/cloudfront v1.58.2/go.mod h1:SxEwhpfvzjK0vR8LfHeOkHeIcpaFU5ZgVbuBo3J4w2A= github.com/aws/aws-sdk-go-v2/service/costexplorer v1.61.0 h1:T9Ms/lReZ3iRFdAtXS9IlhLbWoM2fKUOjJwcgmjT7ig= @@ -128,14 +128,14 @@ github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.7 h1:NHy1+Jq8gVp8fSLF6Z8Saz github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.7/go.mod h1:KxsaVRXo+DeRMHVp65WqyM49XZiS6n74lEGQindkdgA= github.com/aws/aws-sdk-go-v2/service/elasticache v1.50.3 h1:uiWSUtTWqpvhP7KSEpVpIm0LqOtXtzOx049rmukP/gI= github.com/aws/aws-sdk-go-v2/service/elasticache v1.50.3/go.mod h1:igTRxVYuxplMPKS5J1AEThtbeFJQhUz845YtDRDzJhY= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow= -github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.6 h1:P1MU/SuhadGvg2jtviDXPEejU3jBNhoeeAlRadHzvHI= -github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.6/go.mod h1:5KYaMG6wmVKMFBSfWoyG/zH8pWwzQFnKgpoSRlXHKdQ= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.15 h1:3/u/4yZOffg5jdNk1sDpOQ4Y+R6Xbh+GzpDrSZjuy3U= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.15/go.mod h1:4Zkjq0FKjE78NKjabuM4tRXKFzUJWXgP0ItEZK8l7JU= -github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.15 h1:wsSQ4SVz5YE1crz0Ap7VBZrV4nNqZt4CIBBT8mnwoNc= -github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.15/go.mod h1:I7sditnFGtYMIqPRU1QoHZAUrXkGp4SczmlLwrNPlD0= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI= +github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM= +github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA= +github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM= +github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ= github.com/aws/aws-sdk-go-v2/service/kms v1.50.4 h1:PgD1y0ZagPokGIZPmejCBUySBzOFDN+leZxCOfb1OEQ= github.com/aws/aws-sdk-go-v2/service/kms v1.50.4/go.mod h1:FfXDb5nXrsoGgxsBFxwxr3vdHXheC2tV+6lmuLghhjQ= github.com/aws/aws-sdk-go-v2/service/lambda v1.89.0 h1:e4NAllPs/ygQ7W4dTlAuP5N7QpCT+rTij3S8UOv2DD4= @@ -150,8 +150,8 @@ github.com/aws/aws-sdk-go-v2/service/rds v1.97.3 h1:YBcCzc0S/DQN6Mg1sUtcyd8TY6T3 github.com/aws/aws-sdk-go-v2/service/rds v1.97.3/go.mod h1:Xe+NMlf/DY/XTXSevASAjGRika9Qt2LnuCDLtos03ms= github.com/aws/aws-sdk-go-v2/service/redshift v1.58.3 h1:rXoN3hvwUimq8Z6uu2lsYncGPDQS+i70Rp1G0c0C/zk= github.com/aws/aws-sdk-go-v2/service/redshift v1.58.3/go.mod h1:OfB6wMvsEozZQbEjgqe6J68wF5u7wXNEAdG4FLKLk/Y= -github.com/aws/aws-sdk-go-v2/service/s3 v1.93.0 h1:IrbE3B8O9pm3lsg96AXIN5MXX4pECEuExh/A0Du3AuI= -github.com/aws/aws-sdk-go-v2/service/s3 v1.93.0/go.mod h1:/sJLzHtiiZvs6C1RbxS/anSAFwZD6oC6M/kotQzOiLw= +github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo= +github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM= github.com/aws/aws-sdk-go-v2/service/savingsplans v1.31.0 h1:cGxQBpfDQZNtMjGlCd2ALGnKJCjPskOTdCRR+dZceRU= github.com/aws/aws-sdk-go-v2/service/savingsplans v1.31.0/go.mod h1:Osfg3coILx7t46vKS5OWoov989SA4fCoGwSuYrztNEg= github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.40.3 h1:QYBY43OlvzRPww1gSZ1kihyqzXg32rweA3fql5ubSLA= diff --git a/pkg/go.mod b/pkg/go.mod index 3c4f40eb6..28393ba32 100644 --- a/pkg/go.mod +++ b/pkg/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/CUDly/pkg -go 1.25.0 +go 1.26.5 // This module contains shared types, provider interfaces, and the exchange package. // The exchange package has AWS SDK dependencies for RI exchange operations. diff --git a/providers/aws/go.mod b/providers/aws/go.mod index f260749e8..c4ffb8b41 100644 --- a/providers/aws/go.mod +++ b/providers/aws/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/CUDly/providers/aws -go 1.25.0 +go 1.26.5 require ( github.com/LeanerCloud/CUDly/pkg v0.0.0 diff --git a/providers/azure/go.mod b/providers/azure/go.mod index 62bd7b38b..183a7b961 100644 --- a/providers/azure/go.mod +++ b/providers/azure/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/CUDly/providers/azure -go 1.25.0 +go 1.26.5 require ( github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.1 diff --git a/providers/gcp/go.mod b/providers/gcp/go.mod index b8fb550fe..26f7a0da4 100644 --- a/providers/gcp/go.mod +++ b/providers/gcp/go.mod @@ -1,6 +1,6 @@ module github.com/LeanerCloud/CUDly/providers/gcp -go 1.25.0 +go 1.26.5 require ( cloud.google.com/go/compute v1.23.3