chore: bump golang to 1.25.7 because of cve#5938
chore: bump golang to 1.25.7 because of cve#5938Skarlso merged 1 commit intoexternal-secrets:mainfrom
Conversation
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
WalkthroughGo language version is bumped from 1.25.6 to 1.25.7 across the codebase, including Docker base images and go.mod files in root, APIs, generators, providers, and runtime modules. Total of 57 files updated with consistent version change. Changes
Possibly related PRs
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
/ok-to-test sha=4956f923fc95c27b2f17c9e318d8ddc09c1b0b7c |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 3: The go.mod indicates "go 1.25.7" but CI/build images and toolchains
must be updated to match that runtime; update all CI configs, Dockerfiles,
builder images, and any pinned Go toolchain references (e.g., Dockerfiles using
golang:X, GitHub Actions setup-go, Bazel toolchains, or any gn toolchain
manifests) to use Go 1.25.7 so the build environment matches the go 1.25.7
declaration and includes the CVE fixes CVE-2025-61732 and CVE-2025-68121.
In `@providers/v1/delinea/go.mod`:
- Line 3: Update the PR/commit context to document the security fixes in the Go
upgrade: add the two CVE IDs and short descriptions—CVE-2025-61732 (cmd/cgo:
doc-comment code smuggling due to Go vs C/C++ comment parsing) and
CVE-2025-68121 (crypto/tls: unexpected session resumption when using
Config.GetConfigForClient)—and state that they are addressed by upgrading the go
directive to 1.25.7 in providers/v1/delinea/go.mod so reviewers and auditors can
see the security rationale for the version bump.
🧹 Nitpick comments (1)
providers/v1/onepasswordsdk/go.mod (1)
3-3: Consider documenting the CVE identifier in the PR description.While the version bump is correct, it would be helpful to document the specific CVE identifier(s) in the PR description or commit message for future reference and audit trails.
| module github.com/external-secrets/external-secrets | ||
|
|
||
| go 1.25.6 | ||
| go 1.25.7 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Go 1.25.7 release notes CVE fixes
💡 Result:
Go 1.25.7 (released 2026-02-04) includes security fixes in the go command and crypto/tls. [1]
CVE fixes included in Go 1.25.7:
- CVE-2025-61732 (cmd/cgo): potential code smuggling via doc comments due to differences in Go vs C/C++ comment parsing. [2]
- CVE-2025-68121 (crypto/tls): session resumption may incorrectly succeed if the underlying
tls.Configtrust roots (ClientCAs/RootCAs) are mutated between the original and resumed handshakes (e.g., viaConfig.Clone+ mutation orGetConfigForClient). [3]
Sources
[1] https://go.dev/doc/devel/release
[2] https://pkg.go.dev/vuln/GO-2026-4433
[3] https://pkg.go.dev/vuln/GO-2026-4337
Ensure CI/build images are updated to Go 1.25.7 for CVE fixes.
Go 1.25.7 (released 2026-02-04) includes critical security fixes: CVE-2025-61732 (cmd/cgo code smuggling) and CVE-2025-68121 (crypto/tls session resumption trust root mutations). Verify all CI/build toolchains and containers are updated to match this toolchain version.
🤖 Prompt for AI Agents
In `@go.mod` at line 3, The go.mod indicates "go 1.25.7" but CI/build images and
toolchains must be updated to match that runtime; update all CI configs,
Dockerfiles, builder images, and any pinned Go toolchain references (e.g.,
Dockerfiles using golang:X, GitHub Actions setup-go, Bazel toolchains, or any gn
toolchain manifests) to use Go 1.25.7 so the build environment matches the go
1.25.7 declaration and includes the CVE fixes CVE-2025-61732 and CVE-2025-68121.
| module github.com/external-secrets/external-secrets/providers/v1/delinea | ||
|
|
||
| go 1.25.6 | ||
| go 1.25.7 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Go 1.25.7 release
💡 Result:
Go 1.25.7 was released on February 4, 2026. It includes security fixes for the go command and crypto/tls, plus bug fixes for the compiler and crypto/x509. [1]
The upstream release tag is go1.25.7 (tag timestamp: 2026-02-03T20:02:30Z). [2]
Release details / milestone: see the Go 1.25.7 entry in Go’s release history (links to the GitHub milestone). [1]
Download/install: use the standard Go downloads for go1.25.7 (or update via your usual package manager/tooling). [2]
Sources: [1] [2]
🌐 Web query:
Go 1.25.7 CVE security vulnerabilities
💡 Result:
Go 1.25.7 (released 2026-02-04) includes fixes for two CVEs: [1][2]
- CVE-2025-61732 (cmd/cgo): potential code smuggling via doc comments due to differences in Go vs C/C++ comment parsing. Fixed in go1.25.7 (and go1.24.13). [2][3]
- CVE-2025-68121 (crypto/tls): unexpected session resumption when using
Config.GetConfigForClient(and related config mutation patterns), potentially bypassing modified authentication requirements. Fixed in go1.25.7 (and go1.24.13). [2][4]
If you’re on Go 1.25.x, upgrading to 1.25.7 or later addresses both. [1][2]
Document the CVEs addressed by Go 1.25.7 in commit/PR context.
Go 1.25.7 (released February 4, 2026) addresses two CVEs:
- CVE-2025-61732 (cmd/cgo): code smuggling via doc comments due to Go vs C/C++ comment parsing differences
- CVE-2025-68121 (crypto/tls): unexpected session resumption when using
Config.GetConfigForClient, potentially bypassing modified authentication
Consider including these CVE references in the PR description or commit message for clear security context.
🤖 Prompt for AI Agents
In `@providers/v1/delinea/go.mod` at line 3, Update the PR/commit context to
document the security fixes in the Go upgrade: add the two CVE IDs and short
descriptions—CVE-2025-61732 (cmd/cgo: doc-comment code smuggling due to Go vs
C/C++ comment parsing) and CVE-2025-68121 (crypto/tls: unexpected session
resumption when using Config.GetConfigForClient)—and state that they are
addressed by upgrading the go directive to 1.25.7 in providers/v1/delinea/go.mod
so reviewers and auditors can see the security rationale for the version bump.
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
Problem Statement
There is a CVE in 1.25.6
Related Issue
Fixes #...
Proposed Changes
How do you like to solve the issue and why?
Format
Please ensure that your PR follows the following format for the title:
Where
scopeis optionally one of:Checklist
git commit --signoffmake testmake reviewableGo Version Bump to 1.25.7 for CVE Mitigation
This PR bumps the Go toolchain version from 1.25.6 to 1.25.7 across the repository due to a CVE.
Changes:
go.modfiles (apis, e2e, generators, providers, runtime) fromgo 1.25.6togo 1.25.7golang:1.25.6togolang:1.25.7:Dockerfile.standalonee2e/Dockerfiletilt.debug.dockerfileImpact: