From 38c0abffceeac49449c48866d28facd7f0ca285b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Tue, 8 Jul 2025 19:21:37 +0200 Subject: [PATCH] update to go1.24.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5 This minor releases include 1 security fixes following the security policy: - cmd/go: unexpected command execution in untrusted VCS repositories Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directory contains multiple VCS configuration metadata (such as a '.hg' directory in a Git repository). This is due to how the Go toolchain attempts to resolve which VCS is being used in order to embed build information in binaries and determine module versions. The toolchain will now abort attempting to resolve which VCS is being used if it detects multiple VCS configuration metadata in a module directory or nested VCS configuration metadata (such as a '.git' directoy in a parent directory and a '.hg' directory in a child directory). This will not prevent the toolchain from building modules, but will result in binaries omitting VCS related build information. If this behavior is expected by the user, the old behavior can be re-enabled by setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted repositories. Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting this issue. This is CVE-2025-4674 and https://go.dev/issue/74380. View the release notes for more information: https://go.dev/doc/devel/release#go1.24.5 Signed-off-by: Paweł Gronowski (cherry picked from commit 0a047e825cf2b8c6f829c3118eaf9a44311f5f2e) Signed-off-by: Paweł Gronowski --- .github/workflows/.test-unit.yml | 2 +- .github/workflows/.test.yml | 2 +- .github/workflows/.windows.yml | 2 +- .github/workflows/arm64.yml | 2 +- .github/workflows/buildkit.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/test.yml | 2 +- .golangci.yml | 2 +- Dockerfile | 2 +- Dockerfile.simple | 2 +- Dockerfile.windows | 2 +- hack/dockerfiles/generate-files.Dockerfile | 2 +- hack/dockerfiles/govulncheck.Dockerfile | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/.test-unit.yml b/.github/workflows/.test-unit.yml index 36ef0605a2..07d7ac5e8e 100644 --- a/.github/workflows/.test-unit.yml +++ b/.github/workflows/.test-unit.yml @@ -16,7 +16,7 @@ on: workflow_call: env: - GO_VERSION: "1.24.4" + GO_VERSION: "1.24.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.25 SETUP_BUILDX_VERSION: edge diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml index 67c1a5b736..b64b13afa9 100644 --- a/.github/workflows/.test.yml +++ b/.github/workflows/.test.yml @@ -21,7 +21,7 @@ on: default: "graphdriver" env: - GO_VERSION: "1.24.4" + GO_VERSION: "1.24.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.25 ITG_CLI_MATRIX_SIZE: 6 diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml index a16247e38d..fe89bc3a25 100644 --- a/.github/workflows/.windows.yml +++ b/.github/workflows/.windows.yml @@ -28,7 +28,7 @@ on: default: false env: - GO_VERSION: "1.24.4" + GO_VERSION: "1.24.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.25 WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore diff --git a/.github/workflows/arm64.yml b/.github/workflows/arm64.yml index de26e34428..715c6c5aea 100644 --- a/.github/workflows/arm64.yml +++ b/.github/workflows/arm64.yml @@ -23,7 +23,7 @@ on: pull_request: env: - GO_VERSION: "1.24.4" + GO_VERSION: "1.24.5" TESTSTAT_VERSION: v0.1.25 DESTDIR: ./build SETUP_BUILDX_VERSION: edge diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml index aae2939b47..e97b887dac 100644 --- a/.github/workflows/buildkit.yml +++ b/.github/workflows/buildkit.yml @@ -23,7 +23,7 @@ on: pull_request: env: - GO_VERSION: "1.24.4" + GO_VERSION: "1.24.5" DESTDIR: ./build SETUP_BUILDX_VERSION: edge SETUP_BUILDKIT_IMAGE: moby/buildkit:latest diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 27b6ce5c9f..3b7b43259b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -58,7 +58,7 @@ jobs: - name: Update Go uses: actions/setup-go@v5 with: - go-version: "1.24.4" + go-version: "1.24.5" - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 30d7537226..fcb968eabc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -23,7 +23,7 @@ on: pull_request: env: - GO_VERSION: "1.24.4" + GO_VERSION: "1.24.5" GIT_PAGER: "cat" PAGER: "cat" SETUP_BUILDX_VERSION: edge diff --git a/.golangci.yml b/.golangci.yml index 3a869e7d18..add5cdd0bf 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -3,7 +3,7 @@ version: "2" run: # prevent golangci-lint from deducting the go version to lint for through go.mod, # which causes it to fallback to go1.17 semantics. - go: "1.24.4" + go: "1.24.5" concurrency: 2 # Only supported with go modules enabled (build flag -mod=vendor only valid when using modules) # modules-download-mode: vendor diff --git a/Dockerfile b/Dockerfile index 041a40c899..eefa132e5b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" ARG XX_VERSION=1.6.1 diff --git a/Dockerfile.simple b/Dockerfile.simple index d8e721c4f4..05e08a857f 100644 --- a/Dockerfile.simple +++ b/Dockerfile.simple @@ -5,7 +5,7 @@ # This represents the bare minimum required to build and test Docker. -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" diff --git a/Dockerfile.windows b/Dockerfile.windows index b539e9c4f7..5dda1f5e9a 100644 --- a/Dockerfile.windows +++ b/Dockerfile.windows @@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG} # Use PowerShell as the default shell SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG GOTESTSUM_VERSION=v1.12.0 # GOWINRES_VERSION is the version of go-winres to install. diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile index 3b07d64e63..f43776ca45 100644 --- a/hack/dockerfiles/generate-files.Dockerfile +++ b/hack/dockerfiles/generate-files.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG PROTOC_VERSION=3.11.4 diff --git a/hack/dockerfiles/govulncheck.Dockerfile b/hack/dockerfiles/govulncheck.Dockerfile index bff2f61c27..1452f31458 100644 --- a/hack/dockerfiles/govulncheck.Dockerfile +++ b/hack/dockerfiles/govulncheck.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.4 +ARG GO_VERSION=1.24.5 ARG GOVULNCHECK_VERSION=v1.1.4 ARG FORMAT=text