Skip to content

Commit 7b27053

Browse files
geroplona-agent
geropl
and
ona-agent
authored
Fix CVE-2026-27143: bump Go toolchain to 1.25.9 (#21411)
* Fix CVE-2026-27143: bump Go toolchain to 1.25.9 Daily vulnerability scan (CLC-2243) flagged 13 Classic component images with a critical Go stdlib vulnerability: - CVE-2026-27143 (GO-2026-4868): compiler did not correctly check underflow/overflow on arithmetic over induction variables in loops, allowing invalid indexing at runtime that could lead to memory corruption. The vulnerability is fixed in Go 1.25.9 (and 1.26.2). Bump the toolchain across the workspace: - Set toolchain to go1.25.9 in all 71 go.mod files - Update GO_VERSION in dev/image/Dockerfile and bump TRIGGER_REBUILD so the CI dev-environment image installs the patched compiler - Update GO_VERSION in .devcontainer/Dockerfile for dev consistency Verified locally by rebuilding all 13 affected components with GOTOOLCHAIN=go1.25.9 and confirming grype reports zero critical findings. Co-authored-by: Ona <no-reply@ona.com> * Pin golangci-lint --go=1.24 to match CI image toolchain The CI dev-environment image bundles golangci-lint v1.64.8 built with Go 1.24, which refuses to lint code declaring "toolchain go1.25.9". Pin the lint target to 1.24 so the existing image keeps working without a rebuild. We don't use any 1.25 language features; the toolchain bump only addresses CVE-2026-27143 in the Go stdlib. Co-authored-by: Ona <no-reply@ona.com> * Revert toolchain bumps; rely on CI image's system Go for fix The previous commit bumped 'toolchain go1.25.9' across all 71 go.mod files. That worked locally but broke the existing CI dev-environment image, which: 1. ships golangci-lint v1.64.8 built with Go 1.24 (rejects modules declaring toolchain >= 1.25) 2. has system Go 1.24.13, so GOTOOLCHAIN=auto downloads the 1.25.9 toolchain module — but that module's prebuilt tools dir lacks 'covdata', breaking 'go test -coverprofile' for any Go library package. Instead, leave the 'toolchain' directive at go1.24.13 and rely on the new dev-environment image (which has system Go 1.25.9 from dev/image/Dockerfile) to compile binaries with the patched stdlib. Once branch CI publishes the new image, a follow-up commit will update the image tag references in .gitpod.yml and the workflow files (same two-step pattern as #21327). Co-authored-by: Ona <no-reply@ona.com> * Update dev-environment image to ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 This image was published by the previous run of this PR and contains Go 1.25.9, which is needed to compile binaries free of CVE-2026-27143. Switching the workflow and devcontainer references over so subsequent CI runs use the patched toolchain. Co-authored-by: Ona <no-reply@ona.com> --------- Co-authored-by: Ona <no-reply@ona.com>
1 parent 1b94773 commit 7b27053

82 files changed

Lines changed: 103 additions & 103 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.devcontainer/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ RUN curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o aws
193193
./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update && \
194194
rm -rf awscliv2.zip ./aws
195195

196-
ENV GO_VERSION=1.24.13
196+
ENV GO_VERSION=1.25.9
197197
ENV GOPATH=/root/go-packages
198198
ENV GOROOT=/root/go
199199
ENV PATH=$GOROOT/bin:$GOPATH/bin:$PATH

‎.github/workflows/branch-build.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ jobs:
112112
cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }}
113113
runs-on: ubuntu-latest-16-cores
114114
container:
115-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
115+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
116116
options: --user root
117117
steps:
118118
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
@@ -140,7 +140,7 @@ jobs:
140140
(needs.configuration.outputs.is_scheduled_run != 'true')
141141
runs-on: ubuntu-latest
142142
container:
143-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
143+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
144144
options: --user root
145145
concurrency:
146146
group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure
@@ -187,7 +187,7 @@ jobs:
187187
ports:
188188
- 6379:6379
189189
container:
190-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
190+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
191191
options: --user root
192192
env:
193193
DB_HOST: "mysql"
@@ -410,7 +410,7 @@ jobs:
410410
if: needs.configuration.outputs.is_scheduled_run != 'true'
411411
runs-on: ubuntu-latest
412412
container:
413-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
413+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
414414
options: --user root
415415
concurrency:
416416
group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install
@@ -463,7 +463,7 @@ jobs:
463463
environment: branch-build
464464
runs-on: ubuntu-latest
465465
container:
466-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
466+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
467467
options: --user root
468468
if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true'
469469
concurrency:
@@ -492,7 +492,7 @@ jobs:
492492
environment: branch-build
493493
runs-on: ubuntu-latest
494494
container:
495-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
495+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
496496
options: --user root
497497
if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true'
498498
concurrency:

‎.github/workflows/build.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ jobs:
115115
cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }}
116116
runs-on: ubuntu-latest-16-cores
117117
container:
118-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
118+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
119119
options: --user root
120120
steps:
121121
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
@@ -143,7 +143,7 @@ jobs:
143143
(needs.configuration.outputs.is_scheduled_run != 'true')
144144
runs-on: ubuntu-latest
145145
container:
146-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
146+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
147147
options: --user root
148148
concurrency:
149149
group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure
@@ -190,7 +190,7 @@ jobs:
190190
ports:
191191
- 6379:6379
192192
container:
193-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
193+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
194194
options: --user root
195195
env:
196196
DB_HOST: "mysql"
@@ -448,7 +448,7 @@ jobs:
448448
if: needs.configuration.outputs.is_scheduled_run != 'true'
449449
runs-on: ubuntu-latest
450450
container:
451-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
451+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
452452
options: --user root
453453
concurrency:
454454
group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install
@@ -501,7 +501,7 @@ jobs:
501501
environment: main-build
502502
runs-on: ubuntu-latest
503503
container:
504-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
504+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
505505
options: --user root
506506
if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true'
507507
concurrency:
@@ -530,7 +530,7 @@ jobs:
530530
environment: main-build
531531
runs-on: ubuntu-latest
532532
container:
533-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
533+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
534534
options: --user root
535535
if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true'
536536
concurrency:

‎.github/workflows/code-nightly.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
build:
1212
runs-on: ubuntu-latest
1313
container:
14-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
14+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
1515
options: --user root
1616
steps:
1717
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4

‎.github/workflows/ide-integration-tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
name: Configuration
3737
runs-on: ubuntu-latest
3838
container:
39-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
39+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
4040
options: --user root
4141
outputs:
4242
name: ${{ steps.configuration.outputs.name }}
@@ -93,7 +93,7 @@ jobs:
9393
needs: [configuration]
9494
runs-on: ubuntu-latest
9595
container:
96-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
96+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
9797
options: --user root
9898
concurrency:
9999
group: ${{ needs.configuration.outputs.name }}-infrastructure
@@ -126,7 +126,7 @@ jobs:
126126
needs: [configuration, infrastructure]
127127
runs-on: ubuntu-latest
128128
container:
129-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
129+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
130130
options: --user root
131131
volumes:
132132
- /var/tmp:/var/tmp
@@ -216,7 +216,7 @@ jobs:
216216
if: github.event.inputs.skip_delete != 'true' && always()
217217
runs-on: ubuntu-latest
218218
container:
219-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
219+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
220220
options: --user root
221221
steps:
222222
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4

‎.github/workflows/jetbrains-auto-update-template.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
update-jetbrains:
1616
runs-on: ubuntu-latest
1717
container:
18-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
18+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
1919
options: --user root
2020
steps:
2121
- uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # pin@v2

‎.github/workflows/jetbrains-integration-test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ on:
3434
jobs:
3535
jetbrains-smoke-test-linux:
3636
container:
37-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
37+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
3838
options: --user root
3939
runs-on: ubuntu-latest
4040
steps:

‎.github/workflows/preview-env-check-regressions.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
needs: [configuration]
6161
runs-on: ubuntu-latest
6262
container:
63-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
63+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
6464
options: --user root
6565
concurrency:
6666
group: ${{ needs.configuration.outputs.name }}-infrastructure
@@ -93,7 +93,7 @@ jobs:
9393
if: ${{ needs.configuration.outputs.skip == 'false' }}
9494
runs-on: ubuntu-latest
9595
container:
96-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
96+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
9797
options: --user root
9898
volumes:
9999
- /var/tmp:/var/tmp
@@ -171,7 +171,7 @@ jobs:
171171
if: always()
172172
runs-on: ubuntu-latest
173173
container:
174-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
174+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
175175
options: --user root
176176
steps:
177177
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4

‎.github/workflows/preview-env-delete.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
if: github.event.ref_type == 'branch' || github.event.inputs.name != ''
1616
runs-on: ubuntu-latest
1717
container:
18-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
18+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
1919
options: --user root
2020
steps:
2121
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4

‎.github/workflows/preview-env-gc.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
name: "Find stale preview environments"
1212
runs-on: ubuntu-latest
1313
container:
14-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
14+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
1515
options: --user root
1616
outputs:
1717
names: ${{ steps.set-matrix.outputs.names }}
@@ -43,7 +43,7 @@ jobs:
4343
needs: [stale]
4444
runs-on: ubuntu-latest
4545
container:
46-
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
46+
image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275
4747
options: --user root
4848
if: ${{ needs.stale.outputs.count > 0 }}
4949
strategy:

0 commit comments

Comments
 (0)