fix: [CI-23226]: bump Go 1.25.11 + x/crypto/net/otel/go-jose to clear CVEs#101
Open
vinayakharness2026 wants to merge 1 commit into
Conversation
…to clear CVEs Resolves 42 unique Trivy CVEs (31 HIGH / 11 MEDIUM / 1 LOW) in the embedded drone-gcs binary published as harnesssecure/gcs:1.6.10. - module go directive 1.25.7 -> 1.25.11 (covers all stdlib HIGH/MED/LOW) - golang.org/x/crypto v0.46.0 -> v0.52.0 - golang.org/x/net v0.48.0 -> v0.55.0 - go.opentelemetry.io/otel* v1.40.0 -> v1.43.0 - github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4 - CI Go builder images bumped to golang:1.25.11 (was mix of 1.25.7 / 1.23.0) Test image: vinayakharness/gcs-test:gcs-1.6.11--debug JIRA: CI-23226
DevanshMathur19
marked this pull request as ready for review
June 26, 2026 12:21
DevanshMathur19
approved these changes
Jun 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability Remediation: harnesssecure/gcs
Team: ci (Harness CI Platform)
Tickets: CI-23226
Test image:
vinayakharness/gcs-test:gcs-1.6.11--debugOnDemand scanner runs (Harness https://harness0.harness.io):
Summary
Trivy reports the embedded Go binary CVEs went from 42 → 0 unique findings (31 HIGH + 11 MEDIUM + 1 LOW resolved, no new CVEs introduced). Harness OnDemand (Snyk + Prisma Cloud) confirms the same trend: 28 → 2 total findings, 15 HIGH + 1 CRITICAL → 0 in HIGH/CRITICAL severities; the 1 remaining Info is the unchanged
CIS_Docker 4.1non-root-user policy and the 1 Medium isotel/propagation@1.43.0(the package was already at HIGH in the baseline at v1.40.0; upstream has not yet shipped a fix at the time of this run, but Snyk's severity for the bumped version is lower). Recommendation: SHIP.CVE Delta — Trivy (local scan)
CVE Delta — Harness OnDemand (Snyk + Prisma Cloud)
Per-Ticket CVE Status
CI-23226 — P2: Security Vulnerability Fixes - harnesssecure/gcs
The ticket only lists severity counts (10/19/3/1 per the description); the Trivy baseline below enumerates the actual CVEs.
stdlibgolang.org/x/netgolang.org/x/netgolang.org/x/netstdlibstdlibstdlibgo.opentelemetry.io/otelstdlibstdlibstdlibstdlibstdlibstdlibstdlibgolang.org/x/netgithub.com/go-jose/go-jose/v4stdlibgolang.org/x/netstdlibstdlibstdlibgolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptostdlibgo.opentelemetry.io/otel/sdkstdlibgolang.org/x/netstdlibgolang.org/x/netstdlibgolang.org/x/cryptogolang.org/x/cryptogolang.org/x/cryptogolang.org/x/crypto(All ticket-class CVEs are SCA findings against the embedded Go binary; no separate per-CVE issue links.)
Changes Made
go.mod1.25.7→1.25.11; bumpgolang.org/x/cryptov0.46.0→v0.52.0,golang.org/x/netv0.48.0→v0.55.0,go.opentelemetry.io/otel{,/sdk,/sdk/metric,/metric,/trace}v1.40.0→v1.43.0,github.com/go-jose/go-jose/v4v4.1.3→v4.1.4.go mod tidythen refreshed transitive pins.go.sumgo mod tidy..drone.ymlgolang:1.25.11(was a mix of1.25.7and1.23.0); the older1.23.0images would otherwise fail to satisfy the newgo 1.25.11directive..harness/harness.yaml.drone.ymlfor the Harness CI variant.Version selection rationale:
1.25.11, 1.26.4(CVE-2026-42504, CVE-2026-42507); 1.25.11 is the minimum-safe within the current 1.25 line and avoids a major-line jump.golang.org/x/crypto→ v0.52.0 andgolang.org/x/net→ v0.55.0: smallest patches that satisfy every listedfix=requirement; both within the v0.x line.otel/sdkversion that satisfies CVE-2026-39883 (fix=1.43.0); pinned the entire otel surface (otel,otel/sdk,otel/sdk/metric,otel/metric,otel/trace) to the same minor to keep the ecosystem internally consistent.go-jose/v4→ v4.1.4: patch bump (no API change) clearing the only HIGH that remained after the first rebuild (CVE-2026-34986).Newly Introduced CVEs
None reported by Trivy. The OnDemand "Medium" on
otel/propagation@v1.43.0is the same package that was previously HIGH at v1.40.0 — Snyk's severity for v1.43.0 is lower, so the OnDemand delta still shows a strict severity reduction.