Repository navigation
build: update toolchain to Go 1.25.2 - #26909
Merged
Merged
Conversation
Update the Go toolchain to pick up fixes for a small pile of CVEs in the stdlib. Ref: https://go.dev/doc/devel/release#go1.25.2
tgross
force-pushed
the
update-golang-1.25.2
branch
from
October 8, 2025 14:15
996e34a to
9b7898b
Compare
From upstream's description of CVE-2025-47912: > The Parse function permitted values other than IPv6 addresses to be included > in square brackets within the host component of a URL. RFC 3986 permits IPv6 > addresses to be included within the host component, enclosed within square > brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not > appear within square brackets. Parse did not enforce this requirement.
tgross
marked this pull request as ready for review
October 8, 2025 15:06
mismithhisler
approved these changes
Oct 8, 2025
3 of 7 tasks
tgross
added a commit
that referenced
this pull request
Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a x509 certificate parsing that the security patch introduced. Let's upgrade to 1.25.3 before we ship the 1.11.0 beta. Ref: #26909 Ref: https://go.dev/doc/devel/release#go1.25.3
2 of 7 tasks
tgross
added a commit
that referenced
this pull request
Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a x509 certificate parsing that the security patch introduced. Let's upgrade to 1.25.3 before we ship the 1.11.0 beta. Ref: #26909 Ref: https://go.dev/doc/devel/release#go1.25.3
tgross
added a commit
that referenced
this pull request
Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a TLS certificate validation that the security patch introduced. Let's upgrade to 1.25.3 before we ship the 1.11.0 beta. Ref: #26909 Ref: https://go.dev/doc/devel/release#go1.25.3
tgross
added a commit
that referenced
this pull request
Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a TLS certificate validation that the security patch introduced. Let's upgrade to 1.25.3 before we ship the 1.11.0 beta. Ref: #26909 Ref: https://go.dev/doc/devel/release#go1.25.3
2 of 7 tasks
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the Go toolchain to pick up fixes for a small pile of CVEs in the stdlib.
Includes a test fix for our
helper/ipaddrpackage to match current stdlib parsing. From upstream's description of CVE-2025-47912:Ref: https://go.dev/doc/devel/release#go1.25.2
Contributor Checklist
changelog entry using the
make clcommand.ensure regressions will be caught.
and job configuration, please update the Nomad website documentation to reflect this. Refer to
the website README for docs guidelines. Please also consider whether the
change requires notes within the upgrade guide.
Reviewer Checklist
backporting document.
in the majority of situations. The main exceptions are long-lived feature branches or merges where
history should be preserved.
within the public repository.
Changes to Security Controls
Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.