[fix][sec] Bump golang.org/x/net to address CVE-2025-22870, requires go 1.23 #1351
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… requires go 1.23
lhotari
requested review from
gaoran10,
nodece,
BewareMyPower,
tisonkun,
wolfstudy and
Copilot
There was a problem hiding this comment.
Pull Request Overview
This PR bumps golang.org/x/net to v0.38.0 to address CVE-2025-22870 and raises the minimum required Go version to 1.23.
- Update README.md to reflect the new minimum Go version and update test command.
- Modify CI workflows to test on updated Go versions and update the bot workflow runner.
Reviewed Changes
Copilot reviewed 4 out of 7 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| README.md | Minimum required Go version updated and test command now invokes Go 1.23. |
| .github/workflows/ci.yml | Test matrix versions updated from [1.22, 1.23] to [1.23, 1.24]; explicit go-version remains fixed. |
| .github/workflows/bot.yml | Update runner from ubuntu-20.04 to ubuntu-latest. |
Files not reviewed (3)
- Dockerfile: Language not supported
- Makefile: Language not supported
- go.mod: Language not supported
Comments suppressed due to low confidence (2)
.github/workflows/ci.yml:25
- [nitpick] The CI test matrix now includes Go 1.24 even though the PR specifies a minimum version of 1.23. Please confirm that including Go 1.24 is intentional and compatible with project requirements.
go-version: [ '1.23', '1.24' ]
.github/workflows/ci.yml:39
- [nitpick] Consider parameterizing this go-version setting using the matrix variable to ensure the tests run on both specified versions instead of hardcoding '1.23'.
go-version: '1.23'
nodece
approved these changes
Mar 28, 2025
tisonkun
reviewed
Mar 28, 2025
lhotari
force-pushed
the
lh-fix-CVE-2025-22870
branch
from
592944b to
9ca9053
Compare
|
Tests are failing and it looks like the tests aren't executed in the best possible way. |
|
Some progress after removing |
|
I added a solution where it's easier to run tests without For example make TEST_RACE=0 TEST_COVERAGE=0 test_standaloneThis will help finding test issues in the future where there's a failure without any additional information. It's necessary to run without |
- it could cause issues when it's enabled with "-race" - the coverage reports aren't uploaded anywhere
|
I'm disabling |
1 task
RobertIndie
added a commit
that referenced
this pull request
May 15, 2025
### Motivation This PR #1351 introduced some changes but breaked the CI. Currently, even if there are some failed tests, the CI won't be failed: https://github.com/apache/pulsar-client-go/actions/runs/14973771263/job/42060743359?pr=1364#step:6:9285 The root cause is because it captures the exit status of the tee command instead of the go test command. This causes the script to report "Tests passed" even when tests actually fail, leading to false positive CI results. ``` $TEST_CMD 2>&1 | tee $TEST_LOG ``` ### Modification - Use `set -o pipefail` to correctly capture the exit status of the `go test` command in the pipeline
RobertIndie
added a commit
that referenced
this pull request
May 15, 2025
### Motivation This PR #1351 introduced some changes but breaked the CI. Currently, even if there are some failed tests, the CI won't be failed: https://github.com/apache/pulsar-client-go/actions/runs/14973771263/job/42060743359?pr=1364#step:6:9285 The root cause is because it captures the exit status of the tee command instead of the go test command. This causes the script to report "Tests passed" even when tests actually fail, leading to false positive CI results. ``` $TEST_CMD 2>&1 | tee $TEST_LOG ``` ### Modification - Use `set -o pipefail` to correctly capture the exit status of the `go test` command in the pipeline (cherry picked from commit a5c6dee)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
We have an unresolved vulnerability CVE-2025-22870
Modifications
Documentation
Minimum required golang version is updated in README