Skip to content

build: update toolchain to Go 1.25.2 - #26909

Merged
tgross merged 2 commits into
mainfrom
update-golang-1.25.2
Oct 8, 2025
Merged

tgross merged 2 commits into
mainfrom
update-golang-1.25.2

Conversation

@tgross

@tgross tgross commented Oct 8, 2025 •

Copy link
Copy Markdown
Member

Update the Go toolchain to pick up fixes for a small pile of CVEs in the stdlib.

Includes a test fix for our helper/ipaddr package to match current stdlib parsing. From upstream's description of CVE-2025-47912:

The Parse function permitted values other than IPv6 addresses to be included
in square brackets within the host component of a URL. RFC 3986 permits IPv6
addresses to be included within the host component, enclosed within square
brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not
appear within square brackets. Parse did not enforce this requirement.

Ref: https://go.dev/doc/devel/release#go1.25.2

Contributor Checklist

  • Changelog Entry If this PR changes user-facing behavior, please generate and add a
    changelog entry using the make cl command.
  • Testing Please add tests to cover any new functionality or to demonstrate bug fixes and
    ensure regressions will be caught.
  • Documentation If the change impacts user-facing functionality such as the CLI, API, UI,
    and job configuration, please update the Nomad website documentation to reflect this. Refer to
    the website README for docs guidelines. Please also consider whether the
    change requires notes within the upgrade guide.

Reviewer Checklist

  • Backport Labels Please add the correct backport labels as described by the internal
    backporting document.
  • Commit Type Ensure the correct merge method is selected which should be "squash and merge"
    in the majority of situations. The main exceptions are long-lived feature branches or merges where
    history should be preserved.
  • Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
    within the public repository.
  • If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Update the Go toolchain to pick up fixes for a small pile of CVEs in the stdlib.

Ref: https://go.dev/doc/devel/release#go1.25.2
From upstream's description of CVE-2025-47912:
> The Parse function permitted values other than IPv6 addresses to be included
> in square brackets within the host component of a URL. RFC 3986 permits IPv6
> addresses to be included within the host component, enclosed within square
> brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not
> appear within square brackets. Parse did not enforce this requirement.
@tgross
tgross marked this pull request as ready for review October 8, 2025 15:06
@tgross
tgross requested review from a team as code owners October 8, 2025 15:06
@tgross
tgross merged commit b50dbb8 into main Oct 8, 2025
39 of 40 checks passed
@tgross
tgross deleted the update-golang-1.25.2 branch October 8, 2025 15:38
tgross added a commit that referenced this pull request Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a x509
certificate parsing that the security patch introduced. Let's upgrade to 1.25.3
before we ship the 1.11.0 beta.

Ref: #26909
Ref: https://go.dev/doc/devel/release#go1.25.3
@tgross tgross mentioned this pull request Oct 14, 2025
2 of 7 tasks
tgross added a commit that referenced this pull request Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a x509
certificate parsing that the security patch introduced. Let's upgrade to 1.25.3
before we ship the 1.11.0 beta.

Ref: #26909
Ref: https://go.dev/doc/devel/release#go1.25.3
tgross added a commit that referenced this pull request Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a TLS
certificate validation that the security patch introduced. Let's upgrade to
1.25.3 before we ship the 1.11.0 beta.

Ref: #26909
Ref: https://go.dev/doc/devel/release#go1.25.3
tgross added a commit that referenced this pull request Oct 14, 2025
We recently updated to Go 1.25.2 but upstream just released a fix for a TLS
certificate validation that the security patch introduced. Let's upgrade to
1.25.3 before we ship the 1.11.0 beta.

Ref: #26909
Ref: https://go.dev/doc/devel/release#go1.25.3
@github-actions

github-actions Bot commented Feb 6, 2026

Copy link
Copy Markdown

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Feb 6, 2026

This branch was successfully deployed

1 active deployment
Preview – nomad-ui — 2a9c2dde Deployed Oct 8, 2025 by vercel[bot]
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants