fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs - #237
Closed
qiluo-msft wants to merge 1 commit into
Closed
fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs#237qiluo-msft wants to merge 1 commit into
qiluo-msft wants to merge 1 commit into
Conversation
- google.golang.org/grpc v1.28.0 -> v1.82.1 (CVE-2026-33186, GHSA-hrxh-6v49-42gf) - golang.org/x/text v0.3.3 -> v0.39.0 (CVE-2020-14040, CVE-2021-38561, CVE-2026-56852) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287, direct dependency) - antchfx/jsonquery v1.1.4 -> v1.3.7 (parent of vulnerable xpath) - antchfx/xmlquery v1.3.1 -> v1.5.1 (parent of vulnerable xpath) Signed-off-by: qiluo <qiluo@microsoft.com>
|
/azp run |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
Pull request overview
This pull request updates Go module dependency versions in sonic-mgmt-common to remediate CRITICAL/HIGH vulnerabilities reported by Trivy, focusing on gRPC, golang.org/x/text, and the antchfx/* query/xpath stack.
Changes:
- Bumped
google.golang.org/grpcfrom v1.28.0 to v1.82.1. - Bumped
golang.org/x/textfrom v0.3.3 to v0.39.0. - Bumped
github.com/antchfx/{jsonquery,xmlquery,xpath}to newer patched versions.
Suppressed comments (1)
go.mod:21
go.sumdoes not include checksums forgolang.org/x/text v0.39.0andgoogle.golang.org/grpc v1.82.1(it still lists v0.3.3 and v1.28.0). Please regenerate module metadata (go mod tidy) and commit the updated go.sum (and any indirect version bumps) so builds don’t depend on local module cache state.
golang.org/x/text v0.39.0
google.golang.org/grpc v1.82.1
Comment on lines
+5
to
+7
| github.com/antchfx/jsonquery v1.3.7 | ||
| github.com/antchfx/xmlquery v1.5.1 | ||
| github.com/antchfx/xpath v1.3.6 |
3 tasks
Author
|
Superseded by a new PR with go.sum properly updated via go mod tidy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Trivy CVE scan identified multiple CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-mgmt-common.
How I did it
Updated
go.modwith the following version bumps:google.golang.org/grpcgolang.org/x/textgithub.com/antchfx/xpathgithub.com/antchfx/jsonquerygithub.com/antchfx/xmlqueryHow to verify it
trivy fs . --severity CRITICAL,HIGHCRITICAL count should drop to 0 for these packages; HIGH count should decrease substantially.