chore(coraza): bump coraza to v3.7.0, go 1.25, CRS v4.25.0

Author: TheophileDiot

.github/workflows/tests.yml

@@ -80,7 +80,7 @@ jobs:
         if: matrix.lang == 'go'
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: "1.23"
+          go-version: "1.25"
       - name: Run Go unit tests
         if: matrix.lang == 'go'
         working-directory: coraza/api

coraza/api/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine@sha256:04ec5618ca64098b8325e064aa1de2d3efbbd022a3ac5554d49d5ece99d41ad5 AS builder
+FROM golang:1.26-alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b993f6f615648 AS builder
 
 WORKDIR /usr/src/app
 
@@ -11,7 +11,7 @@ COPY --chmod=644 crs.sh .
 RUN apk add bash git && \
     bash crs.sh Download
 
-FROM golang:1.23-alpine@sha256:04ec5618ca64098b8325e064aa1de2d3efbbd022a3ac5554d49d5ece99d41ad5
+FROM golang:1.26-alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b993f6f615648
 
 COPY --from=builder --chown=0:0 /usr/local/bin/bw-coraza /usr/local/bin/bw-coraza
 

coraza/api/crs.sh

@@ -66,7 +66,7 @@ echo "ℹ️ Download CRS or Remove CRS"
 if [[ "$1" == "Remove" ]]; then
   remove_coreruleset
 elif [[ "$1" == "Download" ]]; then
-	git_secure_clone "https://github.com/coreruleset/coreruleset.git" "23196d6a8b3ee2b668bbc26750954501342bfee4" # v4.10.0
+	git_secure_clone "https://github.com/coreruleset/coreruleset.git" "aabf675fcfc5e489b424b844e6c9f1b39802df69" # v4.25.0
 else
 	echo "❌ Error wrong argument : $1 try Remove or Download"
 fi

coraza/api/go.mod

@@ -1,22 +1,31 @@
 module bw-coraza
 
-go 1.23
+go 1.25.0
 
 require (
-	github.com/corazawaf/coraza/v3 v3.3.2
+	github.com/corazawaf/coraza/v3 v3.7.0
 	github.com/gorilla/handlers v1.5.2
 	github.com/gorilla/mux v1.8.1
 )
 
 require (
-	github.com/corazawaf/libinjection-go v0.2.2 // indirect
+	github.com/corazawaf/libinjection-go v0.3.2 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/magefile/mage v1.15.0 // indirect
-	github.com/petar-dambovaliev/aho-corasick v0.0.0-20240411101913-e07a1f0e8eb4 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
+	github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 // indirect
+	github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 // indirect
+	github.com/kaptinlin/go-i18n v0.1.4 // indirect
+	github.com/kaptinlin/jsonschema v0.4.6 // indirect
+	github.com/magefile/mage v1.17.0 // indirect
+	github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
+	github.com/valllabh/ocsf-schema-golang v1.0.3 // indirect
+	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	rsc.io/binaryregexp v0.2.0 // indirect
 )

coraza/api/main.go

@@ -42,7 +42,7 @@ func processInterruption(w http.ResponseWriter, tx types.Transaction, it *types.
 
 	for _, rule := range rules {
 		if rule.Message() != "" {
-			WarningLogger.Printf(rule.AuditLog())
+			WarningLogger.Printf("%s", rule.AuditLog())
 		}
 	}