kelvin/warewulf
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Update to golang v1.25 and x/sys

Browse Source 
Signed-off-by: Jonathon Anderson <janderson@ciq.com>
This commit is contained in:
Jonathon Anderson
2026-03-10 19:00:42 -06:00
committed by Christian Goll
parent 2699f2628f
commit 019408d076
6 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/testsuite.yml vendored
View File

@@ -14,7 +14,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
strategy: strategy:
matrix: matrix:
go-version: ['1.24', '1.25'] go-version: ['1.25', '1.26']
steps: steps:
- name: Checkout Warewulf - name: Checkout Warewulf
uses: actions/checkout@v4 uses: actions/checkout@v4

4
CHANGELOG.md
View File

@@ -16,12 +16,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Error handling for /newroot mount during single-stage boot - Error handling for /newroot mount during single-stage boot
- Bugfix for command-line arguments during single-stage image unpacking - Bugfix for command-line arguments during single-stage image unpacking
- Fix path traversal vulnerability (CWE-23) by validating overlay names in `overlay.Get()` and `overlay.Create()` - Fix path traversal vulnerability (CWE-23) by validating overlay names in `overlay.Get()` and `overlay.Create()`
- Upgrade golang version to 1.24 to resolve stdlib CVEs (CVE-2025-4673, CVE-2025-58187, CVE-2025-61723, CVE-2025-58188, CVE-2025-61725, CVE-2025-61726, CVE-2025-47907, CVE-2025-58189, CVE-2025-47906, CVE-2025-58186, CVE-2025-61727, CVE-2025-61724, CVE-2025-58185, CVE-2025-47912, CVE-2025-61729, CVE-2025-0913, CVE-2025-22873, CVE-2024-45336, CVE-2024-45341, CVE-2025-58183, CVE-2025-68121, CVE-2025-61730) - Upgrade golang version to 1.25 to resolve stdlib CVEs (CVE-2025-4673, CVE-2025-58187, CVE-2025-61723, CVE-2025-58188, CVE-2025-61725, CVE-2025-61726, CVE-2025-47907, CVE-2025-58189, CVE-2025-47906, CVE-2025-58186, CVE-2025-61727, CVE-2025-61724, CVE-2025-58185, CVE-2025-47912, CVE-2025-61729, CVE-2025-0913, CVE-2025-22873, CVE-2024-45336, CVE-2024-45341, CVE-2025-58183, CVE-2025-68121, CVE-2025-61730)
### Dependencies ### Dependencies
- Bump golang.org/x/term from 0.28.0 to 0.40.0 #2037 - Bump golang.org/x/term from 0.28.0 to 0.40.0 #2037
- Bump golang.org/x/sys from 0.29.0 to 0.41.0 #2036 - Bump golang.org/x/sys from 0.29.0 to 0.42.0 #2036
- Bump golang.org/x/crypto from 0.31.0 to 0.48.0 - Bump golang.org/x/crypto from 0.31.0 to 0.48.0
- Bump golang.org/x/net from 0.33.0 to 0.49.0 #1819 - Bump golang.org/x/net from 0.33.0 to 0.49.0 #1819
- Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.26.1 to 2.28.0 #2032 - Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.26.1 to 2.28.0 #2032

2
Dockerfile
View File

@@ -1,6 +1,6 @@
FROM opensuse/tumbleweed:latest AS builder FROM opensuse/tumbleweed:latest AS builder
RUN zypper -n install --no-recommends git go1.24 unzip &&\ RUN zypper -n install --no-recommends git go1.25 unzip &&\
zypper -n install -t pattern devel_basis zypper -n install -t pattern devel_basis
# now build the warewulf # now build the warewulf

2
LICENSE_DEPENDENCIES.md
View File

@@ -477,7 +477,7 @@ The dependencies and their licenses are as follows:
**License:** BSD-3-Clause **License:** BSD-3-Clause
**License URL:** <https://cs.opensource.google/go/x/sys/+/v0.41.0:LICENSE> **License URL:** <https://cs.opensource.google/go/x/sys/+/v0.42.0:LICENSE>
## golang.org/x/term ## golang.org/x/term

6
go.mod
View File

@@ -1,8 +1,6 @@
module github.com/warewulf/warewulf module github.com/warewulf/warewulf
go 1.24.0 go 1.25.0
toolchain go1.24.6
require ( require (
dario.cat/mergo v1.0.2 dario.cat/mergo v1.0.2
@@ -37,7 +35,7 @@ require (
github.com/swaggest/usecase v1.3.1 github.com/swaggest/usecase v1.3.1
golang.org/x/crypto v0.48.0 golang.org/x/crypto v0.48.0
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67
golang.org/x/sys v0.41.0 golang.org/x/sys v0.42.0
golang.org/x/term v0.40.0 golang.org/x/term v0.40.0
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57
google.golang.org/grpc v1.79.2 google.golang.org/grpc v1.79.2

4
go.sum
View File

@@ -453,8 +453,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=