Skip to content

fix(security): remediate CVE vulnerabilities in Go 1.25.9#308

Merged
ulucinar merged 1 commit intorelease-0.10from
fix/cve-remediation-release-0.10-20260417-044200
Apr 17, 2026
Merged

fix(security): remediate CVE vulnerabilities in Go 1.25.9#308
ulucinar merged 1 commit intorelease-0.10from
fix/cve-remediation-release-0.10-20260417-044200

Conversation

@ulucinar
Copy link
Copy Markdown
Collaborator

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
CVE-2026-27140 High Go stdlib 1.25.9
CVE-2026-32283 High Go stdlib 1.25.9
CVE-2026-32280 High Go stdlib 1.25.9
CVE-2026-32281 High Go stdlib 1.25.9
CVE-2026-32289 Medium Go stdlib 1.25.9
CVE-2026-32282 Medium Go stdlib 1.25.9
CVE-2026-32288 Medium Go stdlib 1.25.9

Changes Made

  • Updated Go version from 1.25.8 to 1.25.9 in `go.mod`
  • Updated `GO_VERSION` to `1.25.9` in `.github/workflows/ci.yml`
  • Ran `go mod tidy` to update dependencies

References

Verification

  • Rescanned with `cve-scan` skill after fixes
  • All listed vulnerabilities resolved

- Update Go version to 1.25.9 (fixes CVE-2026-27140, CVE-2026-32283, CVE-2026-32280, CVE-2026-32281, CVE-2026-32289, CVE-2026-32282, CVE-2026-32288)

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
Copy link
Copy Markdown
Collaborator

@sergenyalcin sergenyalcin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ulucinar LGTM!

@ulucinar ulucinar merged commit 074fdfa into release-0.10 Apr 17, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants