Need go v1.24.4 and upgrade packages libarchive, urllib3

[sivani01]

Hi,

we are currently using operator-sdk v1.39.0 as the base image to build our operator. During our Security scan as per the CVEs (https://pkg.go.dev/vuln/GO-2025-3749 and https://pkg.go.dev/vuln/GO-2025-3751) vulnerabilities are reported asking to upgrade to go v1.24.4.

Can we know when a new version of operator-sdk will be released with newer version of golang?

[sivani01]

Hi, any update on this?

There's another vulnerability for the package "libarchive". As per the CVE-2025-5914 we need to upgrade to the version 3.5.3-6.el9_6
Can you please upgrade this package as well in the newer version of operator-sdk.

We also need an upgraded version of urllib3 package as per CVE-2025-50181. Currently the latest operator sdk has v1. 26.20 and the version required is 2.5.0