From fe7fc2ff7f99e64e880dde9690cace1f24ead53d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Mon, 9 Jun 2025 16:22:11 +0200 Subject: [PATCH] update to go1.24.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - https://github.com/golang/go/issues?q=milestone%3AGo1.24.4+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.3...go1.24.4 This release includes 3 security fixes following the security policy: - net/http: sensitive headers not cleared on cross-origin redirect Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2025-4673 and Go issue https://go.dev/issue/73816. - os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink. Thanks to Junyoung Park and Dong-uk Kim of KAIST Hacking Lab for discovering this issue. This is CVE-2025-0913 and Go issue https://go.dev/issue/73702. - crypto/x509: usage of ExtKeyUsageAny disables policy validation Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. Thanks to Krzysztof Skrzętnicki (@Tener) of Teleport for reporting this issue. This is CVE-2025-22874 and Go issue https://go.dev/issue/73612. Signed-off-by: Paweł Gronowski --- .github/workflows/codeql.yml | 2 +- .github/workflows/test.yml | 2 +- .golangci.yml | 2 +- Dockerfile | 2 +- docker-bake.hcl | 2 +- dockerfiles/Dockerfile.dev | 2 +- dockerfiles/Dockerfile.lint | 2 +- dockerfiles/Dockerfile.vendor | 2 +- e2e/testdata/Dockerfile.gencerts | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6d1547b5a0..97796fd3b6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -63,7 +63,7 @@ jobs: name: Update Go uses: actions/setup-go@v5 with: - go-version: "1.24.3" + go-version: "1.24.4" - name: Initialize CodeQL uses: github/codeql-action/init@v3 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 943ee6ea69..4347610641 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -66,7 +66,7 @@ jobs: name: Set up Go uses: actions/setup-go@v5 with: - go-version: "1.24.3" + go-version: "1.24.4" - name: Test run: | diff --git a/.golangci.yml b/.golangci.yml index 7cefcecf0b..c59de3ab3c 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -5,7 +5,7 @@ run: # which causes it to fallback to go1.17 semantics. # # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24 - go: "1.24.3" + go: "1.24.4" timeout: 5m diff --git a/Dockerfile b/Dockerfile index efa9090d20..792ebc6fa4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG BASE_VARIANT=alpine ARG ALPINE_VERSION=3.21 ARG BASE_DEBIAN_DISTRO=bookworm -ARG GO_VERSION=1.24.3 +ARG GO_VERSION=1.24.4 ARG XX_VERSION=1.6.1 ARG GOVERSIONINFO_VERSION=v1.4.1 ARG GOTESTSUM_VERSION=v1.12.0 diff --git a/docker-bake.hcl b/docker-bake.hcl index 82c31041e8..9c2347653d 100644 --- a/docker-bake.hcl +++ b/docker-bake.hcl @@ -1,5 +1,5 @@ variable "GO_VERSION" { - default = "1.24.3" + default = "1.24.4" } variable "VERSION" { default = "" diff --git a/dockerfiles/Dockerfile.dev b/dockerfiles/Dockerfile.dev index c99b07092b..eef2d859db 100644 --- a/dockerfiles/Dockerfile.dev +++ b/dockerfiles/Dockerfile.dev @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.3 +ARG GO_VERSION=1.24.4 ARG ALPINE_VERSION=3.21 # BUILDX_VERSION sets the version of buildx to install in the dev container. diff --git a/dockerfiles/Dockerfile.lint b/dockerfiles/Dockerfile.lint index fbd6126255..199bece864 100644 --- a/dockerfiles/Dockerfile.lint +++ b/dockerfiles/Dockerfile.lint @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.3 +ARG GO_VERSION=1.24.4 ARG ALPINE_VERSION=3.21 ARG GOLANGCI_LINT_VERSION=v2.1.5 diff --git a/dockerfiles/Dockerfile.vendor b/dockerfiles/Dockerfile.vendor index dc469b4a5b..c325a98e28 100644 --- a/dockerfiles/Dockerfile.vendor +++ b/dockerfiles/Dockerfile.vendor @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.3 +ARG GO_VERSION=1.24.4 ARG ALPINE_VERSION=3.21 ARG MODOUTDATED_VERSION=v0.8.0 diff --git a/e2e/testdata/Dockerfile.gencerts b/e2e/testdata/Dockerfile.gencerts index 0f93c19b19..20b4fa287b 100644 --- a/e2e/testdata/Dockerfile.gencerts +++ b/e2e/testdata/Dockerfile.gencerts @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.24.3 +ARG GO_VERSION=1.24.4 FROM golang:${GO_VERSION}-alpine AS generated ENV GOTOOLCHAIN=local