From c867d304256ad5a965232148ba028f236d335d99 Mon Sep 17 00:00:00 2001 From: Qi Luo Date: Thu, 6 Aug 2026 23:29:34 +0000 Subject: [PATCH] [sonic-buildimage]: fix CRITICAL/HIGH CVEs in Go module dependencies Update submodule pointers for sonic-gnmi and sonic-mgmt-common to commits that upgrade vulnerable Go dependencies. Changes per submodule: - sonic-gnmi: grpc v1.64.1->v1.82.1, x/crypto v0.24.0->v0.52.0, x/net v0.26.0->v0.55.0, x/text v0.16.0->v0.39.0, antchfx/xpath v1.1.10->v1.3.6 (CVE-2026-32287) - sonic-mgmt-common: grpc v1.28.0->v1.82.1, x/text v0.3.3->v0.39.0, antchfx/xpath v1.1.10->v1.3.6 (direct dep) Notes: - sonic-telemetry (Azure/sonic-telemetry) is archived/read-only; fix applied locally only - sonic-sysmgr/gnoi (openconfig/gnoi) is third-party; no push access - Separate PRs needed in sonic-gnmi and sonic-mgmt-common submodule repos CVEs fixed: CVE-2026-33186, GHSA-hrxh-6v49-42gf, CVE-2026-32287, CVE-2024-45337, CVE-2025-22869, CVE-2026-39828-39832, CVE-2023-39325, CVE-2024-45338, CVE-2026-25681, CVE-2026-33814, CVE-2026-39821, CVE-2020-14040, CVE-2021-38561, CVE-2022-32149, CVE-2026-56852 Signed-off-by: qiluo --- src/sonic-gnmi | 2 +- src/sonic-mgmt-common | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/sonic-gnmi b/src/sonic-gnmi index b1aa537b842..e302e6cdfe3 160000 --- a/src/sonic-gnmi +++ b/src/sonic-gnmi @@ -1 +1 @@ -Subproject commit b1aa537b84235971af1d6f5740c782f5f541298b +Subproject commit e302e6cdfe375b2ae92d434d30e6ca0f5495344d diff --git a/src/sonic-mgmt-common b/src/sonic-mgmt-common index b944e68e6e1..17ef757c9e1 160000 --- a/src/sonic-mgmt-common +++ b/src/sonic-mgmt-common @@ -1 +1 @@ -Subproject commit b944e68e6e1b3f079d5b3cf1bd2997ee3703f025 +Subproject commit 17ef757c9e1a5e76b67ab48512d5db650e816c02