chore: Bump Go to 1.25.3 to fix CVE-2025-58183 #18458
Conversation
Update all go.mod files to require Go 1.25.3, which includes the fix for CVE-2025-58183 (archive/tar unbounded allocation vulnerability). Problem: The go.mod files declared go 1.25.0, which is vulnerable to CVE-2025-58183. While konflux builds already use Go 1.25.3, local development could use vulnerable versions. Solution: Update all 12 go.mod files to require go 1.25.3 to ensure developers are warned if using older versions and to document the actual Go version requirement. User request: Fix CVE-2025-58183 by upgrading Go version in go.mod files to match the konflux builder (1.25.3). Partially generated by AI.
|
Skipping CI for Draft Pull Request. |
guzalv
added
the
backport release-4.9
guzalv
changed the title
guzalv
removed
the
backport release-4.9
|
Images are ready for the commit at 74774d3. To use with deploy scripts, first |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #18458 +/- ##
=======================================
Coverage 48.92% 48.93%
=======================================
Files 2629 2629
Lines 197814 197814
=======================================
+ Hits 96787 96795 +8
+ Misses 93642 93635 -7
+ Partials 7385 7384 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
guzalv
changed the title
|
/test all |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
@guzalv: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Description
Update all go.mod files to require Go 1.25.3, which includes the fix for CVE-2025-58183 (archive/tar unbounded allocation vulnerability).
Problem: The go.mod files declared go 1.25.0, which is vulnerable to CVE-2025-58183. While konflux builds already use Go 1.25.3, local development could use vulnerable versions.
Solution: Updated all 12 go.mod files to require go 1.25.3 to ensure developers are warned if using older Go versions and to document the actual Go version requirement.
Why: Konflux builder already uses Go 1.25.3, this change ensures consistency between production builds and local development environment requirements.
User-facing documentation
Testing and quality
Automated testing
How I validated my change
docker run --rm brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25@sha256:527782f4a0270f786192281f68d0374f4a21b3ab759643eee4bfcafb6f539468 go version