Update Go to 1.24.6 #31784
Merged
Update Go to 1.24.6 #31784
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lucasmrod
requested review from
a team,
BCTBB,
ddribeiro,
edwardsb,
georgekarrv,
ksatter,
lukeheath and
rfairburn
as code owners
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #31784 +/- ##
=======================================
Coverage ? 63.77%
=======================================
Files ? 1965
Lines ? 192264
Branches ? 6278
=======================================
Hits ? 122616
Misses ? 60059
Partials ? 9589
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
iansltx
previously approved these changes
Aug 11, 2025
Member
iansltx
left a comment
iansltx
left a comment
There was a problem hiding this comment.
Guessing we should cherry-pick this?
Member
Author
I'm all ears. I'm not sure if we have any bugs that can be explained by this CVE/issue. |
iansltx
approved these changes
Aug 11, 2025
lukeheath
approved these changes
Aug 11, 2025
lucasmrod
added a commit
that referenced
this pull request
Aug 12, 2025
Ran ``` make update-go version=1.24.6 ``` And then updated the `sha256`s manually in the Dockerfiles. Fixes https://nvd.nist.gov/vuln/detail/CVE-2025-47907 ``` Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. ```
lukeheath
pushed a commit
that referenced
this pull request
Aug 12, 2025
Cherry pick for #31784. We decided to patch it because 1.24.6 contains a fix for a HIGH CVE: [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) ``` Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. ```
BCTBB
pushed a commit
that referenced
this pull request
Aug 19, 2025
Ran ``` make update-go version=1.24.6 ``` And then updated the `sha256`s manually in the Dockerfiles. Fixes https://nvd.nist.gov/vuln/detail/CVE-2025-47907 ``` Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. ```
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Ran
And then updated the
sha256s manually in the Dockerfiles.Fixes https://nvd.nist.gov/vuln/detail/CVE-2025-47907