fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs - #743
Closed
qiluo-msft wants to merge 7 commits into
Closed
fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs#743qiluo-msft wants to merge 7 commits into
qiluo-msft wants to merge 7 commits into
Conversation
- google.golang.org/grpc v1.69.2 -> v1.82.1 (CVE-2026-33186, GHSA-hrxh-6v49-42gf) - golang.org/x/crypto v0.36.0 -> v0.52.0 (CVE-2024-45337, CVE-2025-22869, CVE-2026-39828-39832) - golang.org/x/net v0.38.0 -> v0.55.0 (CVE-2023-39325, CVE-2024-45338, CVE-2026-25681, CVE-2026-33814) - golang.org/x/text v0.23.0 -> v0.39.0 (CVE-2026-56852) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287) - antchfx/jsonquery v1.1.4 -> v1.3.7 (parent of vulnerable xpath) - antchfx/xmlquery v1.3.1 -> v1.5.1 (parent of vulnerable xpath) Also update replace directives for grpc and crypto to match.
Update replace directives so they no longer downgrade dependencies: - golang.org/x/sys v0.26.0 -> v0.45.0 (matches go mod tidy selection) - google.golang.org/protobuf v1.34.1 -> v1.36.11 (matches require)
The Makefile previously downloaded x/crypto v0.0.0-20191206172530-e9b2fee46413 (Dec 2019) and replaced the vendored modern crypto before building gnmi CLI tools, then restored the modern crypto afterward. This override is incompatible with grpc v1.82.1 which uses crypto APIs added after 2019. The override is no longer needed because: - x/crypto v0.52.0 retains ssh/terminal (used by gnmi_cli) - x/crypto v0.52.0 retains RevokedCertificates as a deprecated alias (used by the 0002-Fix-advance-tls-build-with-go-119.patch) Use the already-vendored modern crypto for all builds.
grpc v1.82.1 and x/sys v0.45.0 require go >= 1.25.0 which breaks CodeQL (uses Go 1.24.13). Use the highest versions that still fix CVE-2026-33186 while requiring only go 1.24.x: - google.golang.org/grpc v1.82.1 -> v1.80.0 (go 1.24.0, fixes CVE-2026-33186) - golang.org/x/crypto v0.52.0 -> v0.48.0 (go 1.24.0, fixes CVE-2024-45337+) - golang.org/x/net v0.55.0 -> v0.49.0 (go 1.24.0) - golang.org/x/text v0.39.0 -> v0.34.0 (go 1.24.0) - golang.org/x/sys v0.45.0 -> v0.40.0 (go 1.24.0) Update replace directives accordingly.
grpc v1.82.1 requires go >= 1.25.0. The CodeQL workflow needs to be updated separately to add 'setup-go: 1.25' step (requires 'workflow' OAuth scope). That change is tracked in the PR description.
Contributor
|
/azp run |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates sonic-gnmi’s Go module dependencies to remediate CRITICAL/HIGH CVEs flagged by Trivy, and adjusts the build vendoring/patch flow to remove an obsolete x/crypto override that conflicts with newer dependency versions.
Changes:
- Upgraded several Go dependencies (notably gRPC and
golang.org/x/*) ingo.modto newer versions intended to address reported CVEs. - Removed the Makefile logic that temporarily overrode vendored
golang.org/x/cryptowith a very old 2019 revision during gNMI client patching. - Updated related indirect dependencies pulled in by the upgraded modules.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| Makefile | Removes the legacy x/crypto vendored-override workflow during client patching; updates build comments accordingly. |
| go.mod | Bumps direct/indirect module versions (including gRPC and x/*) and adjusts replace pins to match the intended upgraded versions. |
| github.com/gogo/protobuf v1.3.2 | ||
| github.com/golang/glog v1.2.4 | ||
| github.com/golang/mock v1.6.0 | ||
| github.com/golang/glog v1.2.5 |
| github.com/golang/glog v1.2.4 | ||
| github.com/golang/mock v1.6.0 | ||
| github.com/golang/glog v1.2.5 | ||
| github.com/golang/mock v1.7.0-rc.1 |
Comment on lines
+124
to
+125
| # use the already-vendored crypto (no longer need the old 2019 override; | ||
| # x/crypto v0.24.0+ retains ssh/terminal and RevokedCertificates backward compat) |
grpc v1.82.1 and x/crypto v0.52.0 require go >= 1.25.0. Without this, CodeQL's 'go get' fallback fails with: google.golang.org/grpc@v1.82.1 requires go >= 1.25.0 (running go 1.24.13)
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
Author
|
Superseded by two focused PRs: #744 (go 1.24 compat, 12 CVEs) and a follow-up for go 1.25+ CVEs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Trivy CVE scan identified multiple CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-gnmi.
How I did it
Updated
go.mod,Makefile, and regeneratedgo.sumviago mod tidywith the following version bumps:google.golang.org/grpcgolang.org/x/cryptogolang.org/x/netgolang.org/x/textgithub.com/antchfx/xpathgithub.com/antchfx/jsonquerygithub.com/antchfx/xmlqueryMakefile change: Removed the obsolete
x/crypto@v0.0.0-20191206172530(Dec 2019) vendor override. This ancient version was incompatible with grpc v1.82.1 and is no longer needed —x/crypto v0.52.0retainsssh/terminalandRevokedCertificatesbackward compatibility.CodeQL fix needed (separate PR): grpc v1.82.1 and x/crypto v0.52.0 require
go >= 1.25.0, but the CodeQL workflow uses the runner's default Go 1.24.x. A reviewer withworkflowscope should add to.github/workflows/codeql-analysis.ymlbefore theInitialize CodeQLstep:How to verify it