From 9bcc88611fae4503d0187264960543c4defabdda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Tue, 8 Jul 2025 19:23:57 +0200 Subject: [PATCH] update to go1.24.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5 This minor releases include 1 security fixes following the security policy: - cmd/go: unexpected command execution in untrusted VCS repositories Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directory contains multiple VCS configuration metadata (such as a '.hg' directory in a Git repository). This is due to how the Go toolchain attempts to resolve which VCS is being used in order to embed build information in binaries and determine module versions. The toolchain will now abort attempting to resolve which VCS is being used if it detects multiple VCS configuration metadata in a module directory or nested VCS configuration metadata (such as a '.git' directoy in a parent directory and a '.hg' directory in a child directory). This will not prevent the toolchain from building modules, but will result in binaries omitting VCS related build information. If this behavior is expected by the user, the old behavior can be re-enabled by setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted repositories. Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting this issue. This is CVE-2025-4674 and https://go.dev/issue/74380. View the release notes for more information: https://go.dev/doc/devel/release#go1.24.5 Signed-off-by: Paweł Gronowski --- .github/workflows/codeql.yml | 2 +- .github/workflows/test.yml | 2 +- .golangci.yml | 2 +- Dockerfile | 2 +- docker-bake.hcl | 2 +- dockerfiles/Dockerfile.dev | 2 +- dockerfiles/Dockerfile.lint | 2 +- dockerfiles/Dockerfile.vendor | 2 +- e2e/testdata/Dockerfile.gencerts | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 97796fd3b6..4ba63f3f03 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -63,7 +63,7 @@ jobs: name: Update Go uses: actions/setup-go@v5 with: - go-version: "1.24.4" + go-version: "1.24.5" - name: Initialize CodeQL uses: github/codeql-action/init@v3 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4347610641..7b84754248 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -66,7 +66,7 @@ jobs: name: Set up Go uses: actions/setup-go@v5 with: - go-version: "1.24.4" + go-version: "1.24.5" - name: Test run: | diff --git a/.golangci.yml b/.golangci.yml index c59de3ab3c..0df356b230 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -5,7 +5,7 @@ run: # which causes it to fallback to go1.17 semantics. # # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24 - go: "1.24.4" + go: "1.24.5" timeout: 5m diff --git a/Dockerfile b/Dockerfile index 792ebc6fa4..f5213cbf18 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG BASE_VARIANT=alpine ARG ALPINE_VERSION=3.21 ARG BASE_DEBIAN_DISTRO=bookworm -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG XX_VERSION=1.6.1 ARG GOVERSIONINFO_VERSION=v1.4.1 ARG GOTESTSUM_VERSION=v1.12.0 diff --git a/docker-bake.hcl b/docker-bake.hcl index 9c2347653d..670e31c1f5 100644 --- a/docker-bake.hcl +++ b/docker-bake.hcl @@ -1,5 +1,5 @@ variable "GO_VERSION" { - default = "1.24.4" + default = "1.24.5" } variable "VERSION" { default = "" diff --git a/dockerfiles/Dockerfile.dev b/dockerfiles/Dockerfile.dev index eef2d859db..4067f16de8 100644 --- a/dockerfiles/Dockerfile.dev +++ b/dockerfiles/Dockerfile.dev @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG ALPINE_VERSION=3.21 # BUILDX_VERSION sets the version of buildx to install in the dev container. diff --git a/dockerfiles/Dockerfile.lint b/dockerfiles/Dockerfile.lint index 199bece864..1f10951328 100644 --- a/dockerfiles/Dockerfile.lint +++ b/dockerfiles/Dockerfile.lint @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG ALPINE_VERSION=3.21 ARG GOLANGCI_LINT_VERSION=v2.1.5 diff --git a/dockerfiles/Dockerfile.vendor b/dockerfiles/Dockerfile.vendor index c325a98e28..4b9cea56b0 100644 --- a/dockerfiles/Dockerfile.vendor +++ b/dockerfiles/Dockerfile.vendor @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG ALPINE_VERSION=3.21 ARG MODOUTDATED_VERSION=v0.8.0 diff --git a/e2e/testdata/Dockerfile.gencerts b/e2e/testdata/Dockerfile.gencerts index 20b4fa287b..390ed58e0b 100644 --- a/e2e/testdata/Dockerfile.gencerts +++ b/e2e/testdata/Dockerfile.gencerts @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 FROM golang:${GO_VERSION}-alpine AS generated ENV GOTOOLCHAIN=local