fix: upgrade Go dependencies to fix CRITICAL/HIGH CVEs (go 1.24 compat) - #744
Closed
qiluo-msft wants to merge 2 commits into
Closed
fix: upgrade Go dependencies to fix CRITICAL/HIGH CVEs (go 1.24 compat)#744qiluo-msft wants to merge 2 commits into
qiluo-msft wants to merge 2 commits into
Conversation
Fixes 12 CVEs using maximum versions compatible with Go 1.24 (no CodeQL issues): - google.golang.org/grpc v1.69.2 -> v1.80.0 (CVE-2026-33186 CRITICAL, GHSA-m425-mq94-257g) - golang.org/x/crypto v0.36.0 -> v0.48.0 (CVE-2024-45337, CVE-2025-22869, CVE-2025-47913) - golang.org/x/net v0.38.0 -> v0.49.0 (CVE-2023-39325, CVE-2023-45288, CVE-2024-45338) - golang.org/x/text v0.23.0 -> v0.34.0 (CVE-2020-14040, CVE-2021-38561, CVE-2022-32149) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287) - antchfx/jsonquery v1.1.4 -> v1.3.7, antchfx/xmlquery v1.3.1 -> v1.5.1 Makefile: remove obsolete x/crypto@v0.0.0-20191206172530 vendor override. The 2019 crypto is no longer needed; x/crypto v0.48.0 retains ssh/terminal and RevokedCertificates backward compatibility. Remaining 11 HIGH CVEs requiring go >= 1.25 are tracked separately.
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates sonic-gnmi’s Go module dependencies (notably gRPC and golang.org/x/*) to remediate CRITICAL/HIGH CVEs while remaining compatible with Go 1.24, and simplifies the build process by removing an obsolete vendored x/crypto override in the Makefile.
Changes:
- Upgraded core dependencies including
google.golang.org/grpc,golang.org/x/crypto,golang.org/x/net, andgolang.org/x/text, plus several transitive modules. - Updated
Makefileto stop temporarily swapping in a 2019x/cryptosnapshot during gNMI CLI patching. - Refreshed several ancillary deps (
testify,yaml.v2, antchfxjsonquery/xmlquery/xpath, etc.) as part of the dependency graph update.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| Makefile | Removes the legacy x/crypto vendor override/restore steps during gNMI CLI patching and cleans up related build artifacts. |
| go.mod | Bumps key direct and indirect module versions (gRPC, x/*, antchfx, etc.) to address CVEs and update the dependency graph for Go 1.24. |
Comment on lines
81
to
84
| golang.org/x/crypto => golang.org/x/crypto v0.48.0 | ||
| golang.org/x/sys => golang.org/x/sys v0.26.0 | ||
| google.golang.org/grpc => google.golang.org/grpc v1.64.1 | ||
| google.golang.org/grpc => google.golang.org/grpc v1.80.0 | ||
| google.golang.org/protobuf => google.golang.org/protobuf v1.34.1 |
Comment on lines
78
to
82
| // Glog patch needs to be updated to remove this. | ||
| github.com/golang/glog => github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b | ||
| github.com/openconfig/gnmi => github.com/openconfig/gnmi v0.0.0-20200617225440-d2b4e6a45802 | ||
| golang.org/x/crypto => golang.org/x/crypto v0.24.0 | ||
| golang.org/x/crypto => golang.org/x/crypto v0.48.0 | ||
| golang.org/x/sys => golang.org/x/sys v0.26.0 |
Pre-existing replace directives were pinning below the versions selected by go mod tidy after the grpc/x/* upgrades: - glog: replace v0.0.0-20160126 -> v1.2.5 (matches require) - x/sys: replace v0.26.0 -> v0.41.0 (matches require) - protobuf: replace v1.34.1 -> v1.36.11 (matches require)
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
Author
|
Superseded by new PR with DCO sign-off fixed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Trivy CVE scan identified CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-gnmi. This PR fixes 12 CVEs using versions compatible with Go 1.24 (no CodeQL workflow changes needed).
A follow-up PR will address the remaining 11 HIGH CVEs that require go ≥ 1.25.
How I did it
google.golang.org/grpcgolang.org/x/cryptogolang.org/x/netgolang.org/x/textgithub.com/antchfx/xpathgithub.com/antchfx/jsonquerygithub.com/antchfx/xmlqueryMakefile: Removed the obsolete
x/crypto@v0.0.0-20191206172530(Dec 2019) vendor override. This ancient version was incompatible with grpc v1.80.0+ and is no longer needed —x/crypto v0.48.0retainsssh/terminalandRevokedCertificatesbackward compatibility.How to verify it
trivy fs . --severity CRITICAL,HIGHCRITICAL count should drop to 0; 11 remaining HIGH CVEs (requiring go ≥ 1.25) will be addressed in a follow-up PR.