Skip to content

OCPBUGS-78658: Update Go to 1.25.8 for CVE-2026-25679 (release-1.2)#134

Merged
alebedev87 merged 1 commit intoopenshift:release-1.2from
Thealisyed:cve-fix-25679
Apr 15, 2026
Merged

OCPBUGS-78658: Update Go to 1.25.8 for CVE-2026-25679 (release-1.2)#134
alebedev87 merged 1 commit intoopenshift:release-1.2from
Thealisyed:cve-fix-25679

Conversation

@Thealisyed
Copy link
Copy Markdown

@Thealisyed Thealisyed commented Mar 25, 2026 •
edited
Loading

Summary

  • Bump Go from 1.25.7 to 1.25.8 in Konflux Containerfile to fix CVE-2026-25679

CVE Details

  • CVE: CVE-2026-25679
  • Go Vuln: GO-2026-4601
  • Severity: Moderate
  • Affected: net/url.Parse — accepted malformed IPv6 host literals
  • Fixed in: Go 1.25.8 / Go 1.26.1

Changes

File Change
Containerfile.externaldns go-toolset:1.25.7 → go-toolset:1.25.8

@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 25, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Mar 25, 2026

@Thealisyed: This pull request references Jira Issue OCPBUGS-78658, which is invalid:

  • release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
  • expected Jira Issue OCPBUGS-78658 to depend on a bug in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Description:

Summary

  • Bump Go from 1.18 to 1.25.8 to fix CVE-2026-25679 (incorrect parsing of IPv6 host literals in net/url)
  • Update all builder and CI images to Go 1.25
  • Fix Go 1.25 compatibility issues (format strings, sort stability, test context types)

CVE Details

  • CVE: CVE-2026-25679
  • Go Vuln: GO-2026-4601
  • Severity: Moderate
  • Affected: net/url.Parse — accepted malformed IPv6 host literals
  • Fixed in: Go 1.25.8 / Go 1.26.1

Changes

File Change
go.mod go 1.18 → go 1.25
Containerfile.externaldns ubi8/go-toolset:1.18.10 → 1.25.8
Dockerfile.openshift rhel-8-golang-1.18-openshift-4.12 → rhel-9-golang-1.25-openshift-4.21
drift-cache/Dockerfile Synced with Dockerfile.openshift
.ci-operator.yaml rhel-8-release-golang-1.18-openshift-4.12 → rhel-9-release-golang-1.25-openshift-4.21
Provider/test files Go 1.25 compatibility fixes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from gcs278 and grzpiotrowski March 25, 2026 16:40
@Thealisyed
Copy link
Copy Markdown
Author

Thealisyed commented Apr 1, 2026

/jira refresh

@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Apr 1, 2026

@Thealisyed: This pull request references Jira Issue OCPBUGS-78658, which is invalid:

  • expected Jira Issue OCPBUGS-78658 to depend on a bug in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@alebedev87
Copy link
Copy Markdown

alebedev87 commented Apr 11, 2026

I keep following up on ExtDNS work. Especially 1-2 and 1-1 releases which we never did before. I'm going to have a look at this one until it's released.

/assign

alebedev87
alebedev87 reviewed Apr 11, 2026
View reviewed changes
Copy link
Copy Markdown

@alebedev87 alebedev87 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please squash/fixup the commits as the only change you need is in Konflux Contrainerfile. Also, can you please change the PR description to reflect the changes. The PR changes golang from 1.25.7 to 1.25.8, not from 1.18.z.

Comment thread drift-cache/Dockerfile
Copy link
Copy Markdown

@alebedev87 alebedev87 Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why this change? We keep using rhel8 on 1.2 release. 4.22 was the right OCP version.

Comment thread .ci-operator.yaml
Copy link
Copy Markdown

@alebedev87 alebedev87 Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment.

Comment thread Dockerfile.openshift
Copy link
Copy Markdown

@alebedev87 alebedev87 Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And the same comment.

@Thealisyed
UPSTREAM: <carry>: Update Go to 1.25.8 for CVE-2026-25679
fa42d4d 
Bump go-toolset from 1.25.7 to 1.25.8 in Konflux Containerfile to fix
CVE-2026-25679 (incorrect parsing of IPv6 host literals in net/url).

Co-assisted-by: Claude
@Thealisyed Thealisyed changed the title OCPBUGS-78658: Update Go to 1.25.8 for CVE-2026-25679 (release-1.2) OCPBUGS-78658: Update Go to 1.25.8 for CVE-2026-25679 (release-1.2) Apr 13, 2026
@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Apr 13, 2026

@Thealisyed: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@alebedev87
Copy link
Copy Markdown

alebedev87 commented Apr 15, 2026

/lgtm
/approve

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 15, 2026
@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Apr 15, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 15, 2026
@alebedev87 alebedev87 merged commit 1d5358e into openshift:release-1.2 Apr 15, 2026
3 of 4 checks passed
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Apr 15, 2026

@Thealisyed: Jira Issue OCPBUGS-78658: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-78658 has been moved to the MODIFIED state.

Details

In response to this:

Summary

  • Bump Go from 1.25.7 to 1.25.8 in Konflux Containerfile to fix CVE-2026-25679

CVE Details

  • CVE: CVE-2026-25679
  • Go Vuln: GO-2026-4601
  • Severity: Moderate
  • Affected: net/url.Parse — accepted malformed IPv6 host literals
  • Fixed in: Go 1.25.8 / Go 1.26.1

Changes

File Change
Containerfile.externaldns go-toolset:1.25.7 → go-toolset:1.25.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alebedev87 alebedev87 alebedev87 left review comments

@gcs278 gcs278 Awaiting requested review from gcs278

@grzpiotrowski grzpiotrowski Awaiting requested review from grzpiotrowski

Assignees

@alebedev87 alebedev87

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Thealisyed @openshift-ci-robot @alebedev87