fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs - #238
Closed
qiluo-msft wants to merge 2 commits into
Closed
fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs#238qiluo-msft wants to merge 2 commits into
qiluo-msft wants to merge 2 commits into
Conversation
- google.golang.org/grpc v1.28.0 -> v1.82.1 (CVE-2026-33186, GHSA-hrxh-6v49-42gf) - golang.org/x/text v0.3.3 -> v0.39.0 (CVE-2020-14040, CVE-2021-38561, CVE-2026-56852) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287, direct dependency) - antchfx/jsonquery v1.1.4 -> v1.3.7 (parent of vulnerable xpath) - antchfx/xmlquery v1.3.1 -> v1.5.1 (parent of vulnerable xpath) Signed-off-by: qiluo <qiluo@microsoft.com>
Signed-off-by: qiluo <qiluo@microsoft.com>
|
/azp run |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
Pull request overview
Updates this repo’s Go module dependencies to address reported CRITICAL/HIGH CVEs in core libraries used by translib/cvl and related tooling.
Changes:
- Bumped
google.golang.org/grpctov1.82.1andgolang.org/x/texttov0.39.0, plus related dependency updates ingo.mod. - Updated antchfx JSON/XML/XPath modules to newer releases and refreshed
go.sumaccordingly. - Bumped the module
godirective to1.25.0(not mentioned in the PR description).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Updates direct/indirect dependency versions (incl. grpc/x/text) and raises the go directive. |
| go.sum | Regenerates dependency checksums to match the new module graph. |
| ) | ||
|
|
||
| go 1.24.4 | ||
| go 1.25.0 |
Author
|
Superseded by updated PR with rebase on latest master. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Trivy CVE scan identified multiple CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-mgmt-common.
How I did it
Updated
go.modand rango mod tidyto regeneratego.sumwith the following version bumps:google.golang.org/grpcgolang.org/x/textgithub.com/antchfx/xpathgithub.com/antchfx/jsonquerygithub.com/antchfx/xmlqueryHow to verify it
trivy fs . --severity CRITICAL,HIGHCRITICAL count should drop to 0 for these packages; HIGH count should decrease substantially.