fix: rebuild binaries using Go 1.25.5 to address CVE-2025-61729 #2682
Conversation
WalkthroughGo toolchain version updated from 1.25.1/1.25.4 to 1.25.5 across GitHub Actions workflows, Dockerfiles, and go.mod configuration files to standardize the build and deployment environment. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.workis excluded by!**/*.work
📒 Files selected for processing (8)
.github/workflows/coverage.yml(1 hunks).github/workflows/nightly.yaml(1 hunks).github/workflows/release.yml(1 hunks)Dockerfile(1 hunks)Dockerfile.local(1 hunks)Dockerfile.release(1 hunks)go.mod(1 hunks)sdk/go/grpc/go.mod(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Test with Coverage
- GitHub Check: Analyze (go)
- GitHub Check: Test with Coverage
🔇 Additional comments (7)
go.mod (1)
3-3: Approve the Go toolchain version bump.The go.mod file correctly updates the Go version directive to 1.25.5. No changes to require blocks or public APIs, which is appropriate for a patch version update to address a security vulnerability.
.github/workflows/nightly.yaml (1)
26-26: Approve the Go version update in nightly workflow.The semantic version constraint
~1.25.5appropriately restricts to patch versions >= 1.25.5 and < 1.26.0, which is suitable for a security patch release workflow.sdk/go/grpc/go.mod (1)
3-3: Approve the Go version update in SDK go.mod.The gRPC SDK's go.mod correctly updates to Go 1.25.5, maintaining consistency with the root go.mod file. No other dependencies or configurations are affected.
.github/workflows/release.yml (1)
26-26: Approve the Go version update in release workflow.The semantic version constraint
~1.25.5is consistent with the nightly workflow and ensures release builds use the patched Go version and any subsequent 1.25.x patches without crossing major or minor version boundaries.Dockerfile.local (1)
2-2: Verify the Docker image digest is correct.This file uses the same golang:1.25.5-alpine digest as the main Dockerfile. The digest validity should be confirmed as part of the main Dockerfile verification.
Dockerfile.release (1)
2-2: Verify the Docker image digest is correct.This file also uses the golang:1.25.5-alpine digest. Confirm the digest validity along with the main Dockerfile check.
.github/workflows/coverage.yml (1)
26-26: Update to Go 1.25.5 addresses CVE-2025-61729 — a DoS vulnerability in crypto/x509.Go 1.25.5 fixes CVE-2025-61729, which allows excessive resource consumption (quadratic-time CPU/memory usage) when printing HostnameError exceptions with unbounded host lists. This patch is security-critical for applications processing untrusted certificates. The update also includes CVE-2025-61727 (wildcard SAN constraint bypass fix).
| @@ -1,10 +1,10 @@ | |||
| FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS permify-builder | |||
| FROM golang:1.25.5-alpine@sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 AS permify-builder | |||
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
golang:1.25.5-alpine sha256 digest Docker Hub
💡 Result:
I found two image digests shown on Docker Hub for golang:1.25.5-alpine:
- sha256:6d6d1e4e530e8512543843504590c86b30524dd8644953c3435fa5b3396ae39c. [1]
- sha256:c07ca287f049960e8b699d433376d879b7ee3e576b1e0239c476d9b28c6343c4. [2]
Note: multi‑arch images often show a manifest-list digest and per‑platform image digests; use docker pull golang:1.25.5-alpine (the CLI prints the digest you pulled) or docker manifest inspect / Registry API to confirm the exact digest for your platform. [2]
Update the Docker image digest for golang:1.25.5-alpine.
The digest sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 pinned on lines 1 and 7 does not match the official golang:1.25.5-alpine image on Docker Hub. The correct digests are:
sha256:6d6d1e4e530e8512543843504590c86b30524dd8644953c3435fa5b3396ae39csha256:c07ca287f049960e8b699d433376d879b7ee3e576b1e0239c476d9b28c6343c4
(Exact digest depends on platform architecture.) Update both stages to use the correct digest to ensure reproducibility and security.
🤖 Prompt for AI Agents
In Dockerfile around lines 1 and 7, the pinned digest for golang:1.25.5-alpine
is incorrect; replace the bad
sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 with one
of the official digests for golang:1.25.5-alpine (for your target platform) —
either sha256:6d6d1e4e530e8512543843504590c86b30524dd8644953c3435fa5b3396ae39c
or sha256:c07ca287f049960e8b699d433376d879b7ee3e576b1e0239c476d9b28c6343c4 — and
update both FROM lines (both stages) to use the chosen correct digest to ensure
reproducible, secure builds.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2682 +/- ##
==========================================
- Coverage 82.59% 82.58% -0.01%
==========================================
Files 74 74
Lines 8125 8125
==========================================
- Hits 6710 6709 -1
- Misses 901 902 +1
Partials 514 514 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.