From 2a091291a0c10ed76ac7554b6e99c894b3d5047c Mon Sep 17 00:00:00 2001 From: Gero Posmyk-Leinemann Date: Thu, 23 Apr 2026 06:40:10 +0000 Subject: [PATCH 1/4] Fix CVE-2026-27143: bump Go toolchain to 1.25.9 Daily vulnerability scan (CLC-2243) flagged 13 Classic component images with a critical Go stdlib vulnerability: - CVE-2026-27143 (GO-2026-4868): compiler did not correctly check underflow/overflow on arithmetic over induction variables in loops, allowing invalid indexing at runtime that could lead to memory corruption. The vulnerability is fixed in Go 1.25.9 (and 1.26.2). Bump the toolchain across the workspace: - Set toolchain to go1.25.9 in all 71 go.mod files - Update GO_VERSION in dev/image/Dockerfile and bump TRIGGER_REBUILD so the CI dev-environment image installs the patched compiler - Update GO_VERSION in .devcontainer/Dockerfile for dev consistency Verified locally by rebuilding all 13 affected components with GOTOOLCHAIN=go1.25.9 and confirming grype reports zero critical findings. Co-authored-by: Ona --- .devcontainer/Dockerfile | 2 +- components/blobserve/go.mod | 2 +- components/common-go/go.mod | 2 +- components/content-service-api/go/go.mod | 2 +- components/content-service-api/typescript/util/go.mod | 2 +- components/content-service/go.mod | 2 +- components/docker-up/go.mod | 2 +- components/ee/agent-smith/cmd/testbed/go.mod | 2 +- components/ee/agent-smith/cmd/testtarget/go.mod | 2 +- components/ee/agent-smith/go.mod | 2 +- components/gitpod-cli/go.mod | 2 +- components/gitpod-db/go/go.mod | 2 +- components/gitpod-protocol/go/go.mod | 2 +- components/ide-metrics-api/go.mod | 2 +- components/ide-metrics-api/go/go.mod | 2 +- components/ide-metrics/go.mod | 2 +- components/ide-service-api/go/go.mod | 2 +- components/ide-service/go.mod | 2 +- components/ide/code-desktop/status/go.mod | 2 +- components/ide/code/codehelper/go.mod | 2 +- components/ide/jetbrains/cli/go.mod | 2 +- components/ide/jetbrains/launcher/go.mod | 2 +- components/image-builder-api/go.mod | 2 +- components/image-builder-api/go/go.mod | 2 +- components/image-builder-bob/go.mod | 2 +- components/image-builder-mk3/go.mod | 2 +- components/local-app-api/go.mod | 2 +- components/local-app-api/go/go.mod | 2 +- components/local-app/go.mod | 2 +- components/node-labeler/go.mod | 2 +- components/openvsx-proxy/go.mod | 2 +- components/public-api-server/go.mod | 2 +- components/public-api/go/go.mod | 2 +- components/registry-facade-api/go.mod | 2 +- components/registry-facade-api/go/go.mod | 2 +- components/registry-facade/go.mod | 2 +- components/scrubber/go.mod | 2 +- components/server/go/go.mod | 2 +- components/service-waiter/go.mod | 2 +- components/spicedb/codegen/go.mod | 2 +- components/spicedb/go.mod | 2 +- components/supervisor-api/go.mod | 2 +- components/supervisor-api/go/go.mod | 2 +- components/supervisor/go.mod | 2 +- components/usage-api/go/go.mod | 2 +- components/usage/go.mod | 2 +- components/workspacekit/go.mod | 2 +- components/ws-daemon-api/go.mod | 2 +- components/ws-daemon-api/go/go.mod | 2 +- components/ws-daemon/go.mod | 2 +- components/ws-daemon/nsinsider/go.mod | 2 +- components/ws-daemon/seccomp-profile-installer/go.mod | 2 +- components/ws-manager-api/go.mod | 2 +- components/ws-manager-api/go/go.mod | 2 +- components/ws-manager-bridge-api/go/go.mod | 2 +- components/ws-manager-mk2/go.mod | 2 +- components/ws-proxy/go.mod | 2 +- dev/addlicense/go.mod | 2 +- dev/blowtorch/go.mod | 2 +- dev/changelog/go.mod | 2 +- dev/gp-gcloud/go.mod | 2 +- dev/gpctl/go.mod | 2 +- dev/image/Dockerfile | 6 +++--- dev/kubecdl/go.mod | 2 +- dev/loadgen/go.mod | 2 +- dev/preview/previewctl/go.mod | 2 +- dev/rejector/go.mod | 2 +- dev/ssh-load-test/go.mod | 2 +- dev/version-manifest/go.mod | 2 +- install/installer/go.mod | 2 +- install/preview/prettylog/go.mod | 2 +- operations/observability/mixins/go.mod | 2 +- test/go.mod | 2 +- 73 files changed, 75 insertions(+), 75 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index b3540b5a83d890..7360858b7459d6 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -193,7 +193,7 @@ RUN curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o aws ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update && \ rm -rf awscliv2.zip ./aws -ENV GO_VERSION=1.24.13 +ENV GO_VERSION=1.25.9 ENV GOPATH=/root/go-packages ENV GOROOT=/root/go ENV PATH=$GOROOT/bin:$GOPATH/bin:$PATH diff --git a/components/blobserve/go.mod b/components/blobserve/go.mod index 554cf8b85ab63d..10b77542b2b580 100644 --- a/components/blobserve/go.mod +++ b/components/blobserve/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/blobserve go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/common-go/go.mod b/components/common-go/go.mod index fbe659ff3830d0..87c010628ae648 100644 --- a/components/common-go/go.mod +++ b/components/common-go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/common-go go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/content-service-api/go/go.mod b/components/content-service-api/go/go.mod index e2f3726f79c3cb..85da1bffa1988c 100644 --- a/components/content-service-api/go/go.mod +++ b/components/content-service-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/content-service/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/content-service-api/typescript/util/go.mod b/components/content-service-api/typescript/util/go.mod index 23f54068989dd1..b689e445fa71be 100644 --- a/components/content-service-api/typescript/util/go.mod +++ b/components/content-service-api/typescript/util/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/content-service-api/util go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/content-service/go.mod b/components/content-service/go.mod index 37f6bb9c003a3d..2cf19537eea49f 100644 --- a/components/content-service/go.mod +++ b/components/content-service/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/content-service go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/docker-up/go.mod b/components/docker-up/go.mod index 03eea9394ffef3..0c1542b21de774 100644 --- a/components/docker-up/go.mod +++ b/components/docker-up/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/docker-up go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ee/agent-smith/cmd/testbed/go.mod b/components/ee/agent-smith/cmd/testbed/go.mod index 659c9752ae9060..69f57b5fd329c0 100644 --- a/components/ee/agent-smith/cmd/testbed/go.mod +++ b/components/ee/agent-smith/cmd/testbed/go.mod @@ -2,6 +2,6 @@ module testbed go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ee/agent-smith/cmd/testtarget/go.mod b/components/ee/agent-smith/cmd/testtarget/go.mod index b9c7cf0df23d7f..c092cc6481dc7f 100644 --- a/components/ee/agent-smith/cmd/testtarget/go.mod +++ b/components/ee/agent-smith/cmd/testtarget/go.mod @@ -2,6 +2,6 @@ module testtarget go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ee/agent-smith/go.mod b/components/ee/agent-smith/go.mod index 79696646d2d741..181385959e4464 100644 --- a/components/ee/agent-smith/go.mod +++ b/components/ee/agent-smith/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/agent-smith go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/gitpod-cli/go.mod b/components/gitpod-cli/go.mod index 9092cb2c1def19..22da358e0d9d7e 100644 --- a/components/gitpod-cli/go.mod +++ b/components/gitpod-cli/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gitpod-cli go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/gitpod-db/go/go.mod b/components/gitpod-db/go/go.mod index 0869bb1ad08fe0..e9c616e0b8589c 100644 --- a/components/gitpod-db/go/go.mod +++ b/components/gitpod-db/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/gitpod-db/go go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/gitpod-protocol/go/go.mod b/components/gitpod-protocol/go/go.mod index 0b0b0c021fea5c..94a6f95a7ee888 100644 --- a/components/gitpod-protocol/go/go.mod +++ b/components/gitpod-protocol/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gitpod-protocol go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide-metrics-api/go.mod b/components/ide-metrics-api/go.mod index 9b6b5198b97ecb..37a45f5ab67eeb 100644 --- a/components/ide-metrics-api/go.mod +++ b/components/ide-metrics-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide-metrics-api/go/go.mod b/components/ide-metrics-api/go/go.mod index 2f9281d4dfc048..3d91bf5e638127 100644 --- a/components/ide-metrics-api/go/go.mod +++ b/components/ide-metrics-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-metrics-api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide-metrics/go.mod b/components/ide-metrics/go.mod index 93bb4334106f89..65d73a28380f17 100644 --- a/components/ide-metrics/go.mod +++ b/components/ide-metrics/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-metrics go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide-service-api/go/go.mod b/components/ide-service-api/go/go.mod index de086cc100f723..150c0e6167a618 100644 --- a/components/ide-service-api/go/go.mod +++ b/components/ide-service-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-service-api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide-service/go.mod b/components/ide-service/go.mod index 135a0ff052be3d..04a3a5630c2b66 100644 --- a/components/ide-service/go.mod +++ b/components/ide-service/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-service go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide/code-desktop/status/go.mod b/components/ide/code-desktop/status/go.mod index 92ee538728f8ad..c71bdd26eebfbf 100644 --- a/components/ide/code-desktop/status/go.mod +++ b/components/ide/code-desktop/status/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/code-desktop/status go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide/code/codehelper/go.mod b/components/ide/code/codehelper/go.mod index 2c63d3ddd8e288..69c29c949c3704 100644 --- a/components/ide/code/codehelper/go.mod +++ b/components/ide/code/codehelper/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/code/codehelper go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide/jetbrains/cli/go.mod b/components/ide/jetbrains/cli/go.mod index 57c5f08e5ec7cd..7230eb7849c923 100644 --- a/components/ide/jetbrains/cli/go.mod +++ b/components/ide/jetbrains/cli/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/jetbrains/cli go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ide/jetbrains/launcher/go.mod b/components/ide/jetbrains/launcher/go.mod index 4d6aab9d0729a9..a02c12aed63d50 100644 --- a/components/ide/jetbrains/launcher/go.mod +++ b/components/ide/jetbrains/launcher/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/jetbrains/launcher go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/image-builder-api/go.mod b/components/image-builder-api/go.mod index 9b6b5198b97ecb..37a45f5ab67eeb 100644 --- a/components/image-builder-api/go.mod +++ b/components/image-builder-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/image-builder-api/go/go.mod b/components/image-builder-api/go/go.mod index 6d2deb80719f94..edcbbe5785f0a4 100644 --- a/components/image-builder-api/go/go.mod +++ b/components/image-builder-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/image-builder/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/image-builder-bob/go.mod b/components/image-builder-bob/go.mod index 959208ebad3c56..91cedeff7c1282 100644 --- a/components/image-builder-bob/go.mod +++ b/components/image-builder-bob/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/image-builder/bob go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/image-builder-mk3/go.mod b/components/image-builder-mk3/go.mod index 734dd2c7daff3d..5fbcb15bcdd623 100644 --- a/components/image-builder-mk3/go.mod +++ b/components/image-builder-mk3/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/image-builder go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/local-app-api/go.mod b/components/local-app-api/go.mod index 9b6b5198b97ecb..37a45f5ab67eeb 100644 --- a/components/local-app-api/go.mod +++ b/components/local-app-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/local-app-api/go/go.mod b/components/local-app-api/go/go.mod index c18ef859603416..b9b5ec12014e49 100644 --- a/components/local-app-api/go/go.mod +++ b/components/local-app-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/local-app/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/local-app/go.mod b/components/local-app/go.mod index 601519daa35e67..f397234119f75d 100644 --- a/components/local-app/go.mod +++ b/components/local-app/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/local-app go 1.24.0 -toolchain go1.24.13 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/node-labeler/go.mod b/components/node-labeler/go.mod index d8e200649a39b6..b950408b45a4e2 100644 --- a/components/node-labeler/go.mod +++ b/components/node-labeler/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/node-labeler go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/openvsx-proxy/go.mod b/components/openvsx-proxy/go.mod index 4f0b27d73304f1..be4fb3080d9443 100644 --- a/components/openvsx-proxy/go.mod +++ b/components/openvsx-proxy/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/openvsx-proxy go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/public-api-server/go.mod b/components/public-api-server/go.mod index daa2089c3acd51..b984c94a64327d 100644 --- a/components/public-api-server/go.mod +++ b/components/public-api-server/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/public-api-server go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/public-api/go/go.mod b/components/public-api/go/go.mod index bbd2fa5e999345..34e3135bbac0c5 100644 --- a/components/public-api/go/go.mod +++ b/components/public-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/public-api/go go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/registry-facade-api/go.mod b/components/registry-facade-api/go.mod index 9b6b5198b97ecb..37a45f5ab67eeb 100644 --- a/components/registry-facade-api/go.mod +++ b/components/registry-facade-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/registry-facade-api/go/go.mod b/components/registry-facade-api/go/go.mod index b5f668adf207bf..c014cc96476120 100644 --- a/components/registry-facade-api/go/go.mod +++ b/components/registry-facade-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/registry-facade/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/registry-facade/go.mod b/components/registry-facade/go.mod index 00f59618ecbcc8..8d66ffd48eb13f 100644 --- a/components/registry-facade/go.mod +++ b/components/registry-facade/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/registry-facade go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/scrubber/go.mod b/components/scrubber/go.mod index aa5f589ff04e7f..ecce6aaf8e12e9 100644 --- a/components/scrubber/go.mod +++ b/components/scrubber/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/scrubber go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/server/go/go.mod b/components/server/go/go.mod index abb18d8498ea84..0936a0d6be57d9 100644 --- a/components/server/go/go.mod +++ b/components/server/go/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/gitpod/server/go go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/service-waiter/go.mod b/components/service-waiter/go.mod index f2f78f43cc08f9..3127343c908558 100644 --- a/components/service-waiter/go.mod +++ b/components/service-waiter/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/service-waiter go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/spicedb/codegen/go.mod b/components/spicedb/codegen/go.mod index daa856ae3a00d8..af89e7e0441b45 100644 --- a/components/spicedb/codegen/go.mod +++ b/components/spicedb/codegen/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/spicedb/codegen go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/spicedb/go.mod b/components/spicedb/go.mod index 3b95157e5ab954..2da10f671d465a 100644 --- a/components/spicedb/go.mod +++ b/components/spicedb/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/spicedb go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/supervisor-api/go.mod b/components/supervisor-api/go.mod index 9b6b5198b97ecb..37a45f5ab67eeb 100644 --- a/components/supervisor-api/go.mod +++ b/components/supervisor-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/supervisor-api/go/go.mod b/components/supervisor-api/go/go.mod index eab7c40f0c0c08..3c7af8b88bead1 100644 --- a/components/supervisor-api/go/go.mod +++ b/components/supervisor-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/supervisor/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/supervisor/go.mod b/components/supervisor/go.mod index 2f7b9b6984faa2..0fd2910565e596 100644 --- a/components/supervisor/go.mod +++ b/components/supervisor/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/supervisor go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/usage-api/go/go.mod b/components/usage-api/go/go.mod index 52f5c26036ff03..3b43a7ea9a2401 100644 --- a/components/usage-api/go/go.mod +++ b/components/usage-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/usage-api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/usage/go.mod b/components/usage/go.mod index af352e3e4c3c85..4b9351b1b1999e 100644 --- a/components/usage/go.mod +++ b/components/usage/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/usage go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/workspacekit/go.mod b/components/workspacekit/go.mod index 0966c64c41ff5a..94ccfca347c191 100644 --- a/components/workspacekit/go.mod +++ b/components/workspacekit/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/workspacekit go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-daemon-api/go.mod b/components/ws-daemon-api/go.mod index 9b6b5198b97ecb..37a45f5ab67eeb 100644 --- a/components/ws-daemon-api/go.mod +++ b/components/ws-daemon-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-daemon-api/go/go.mod b/components/ws-daemon-api/go/go.mod index ca27c1f95f13c4..e0418fd5184269 100644 --- a/components/ws-daemon-api/go/go.mod +++ b/components/ws-daemon-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-daemon/go.mod b/components/ws-daemon/go.mod index 7803977d95c632..b68cbfdf23b657 100644 --- a/components/ws-daemon/go.mod +++ b/components/ws-daemon/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-daemon/nsinsider/go.mod b/components/ws-daemon/nsinsider/go.mod index 7431b3e417e8c9..468f2f54aff7bb 100644 --- a/components/ws-daemon/nsinsider/go.mod +++ b/components/ws-daemon/nsinsider/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon/nsinsider go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-daemon/seccomp-profile-installer/go.mod b/components/ws-daemon/seccomp-profile-installer/go.mod index 8669779dea6a36..1a0324d02f4ace 100644 --- a/components/ws-daemon/seccomp-profile-installer/go.mod +++ b/components/ws-daemon/seccomp-profile-installer/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon/seccomp-profile-installer go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-manager-api/go.mod b/components/ws-manager-api/go.mod index 9b6b5198b97ecb..37a45f5ab67eeb 100644 --- a/components/ws-manager-api/go.mod +++ b/components/ws-manager-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-manager-api/go/go.mod b/components/ws-manager-api/go/go.mod index 3cbb5d6db6d7e8..bb2396c1d1f389 100644 --- a/components/ws-manager-api/go/go.mod +++ b/components/ws-manager-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-manager/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-manager-bridge-api/go/go.mod b/components/ws-manager-bridge-api/go/go.mod index 8371503e89ddaf..d98276df729f4e 100644 --- a/components/ws-manager-bridge-api/go/go.mod +++ b/components/ws-manager-bridge-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-manager-bridge/api go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-manager-mk2/go.mod b/components/ws-manager-mk2/go.mod index c1d8a5cbaf5106..7f959a08a566f9 100644 --- a/components/ws-manager-mk2/go.mod +++ b/components/ws-manager-mk2/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-manager-mk2 go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/components/ws-proxy/go.mod b/components/ws-proxy/go.mod index df18722ce8e587..248b8b0cde0d0b 100644 --- a/components/ws-proxy/go.mod +++ b/components/ws-proxy/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-proxy go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/addlicense/go.mod b/dev/addlicense/go.mod index d1d0fbdde70ab4..701f3e6757635f 100644 --- a/dev/addlicense/go.mod +++ b/dev/addlicense/go.mod @@ -2,7 +2,7 @@ module github.com/google/addlicense go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/blowtorch/go.mod b/dev/blowtorch/go.mod index bc3592e9e9ec8c..cf60d2b23a9c4e 100644 --- a/dev/blowtorch/go.mod +++ b/dev/blowtorch/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/blowtorch go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/changelog/go.mod b/dev/changelog/go.mod index 50f59446e738b2..d776424f65783c 100644 --- a/dev/changelog/go.mod +++ b/dev/changelog/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/changelog go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/gp-gcloud/go.mod b/dev/gp-gcloud/go.mod index a007750eebb900..1479dad422b306 100644 --- a/dev/gp-gcloud/go.mod +++ b/dev/gp-gcloud/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gp-gcloud go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/gpctl/go.mod b/dev/gpctl/go.mod index 02fde2b2f907c6..9ee26edfb7fa60 100644 --- a/dev/gpctl/go.mod +++ b/dev/gpctl/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gpctl go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/image/Dockerfile b/dev/image/Dockerfile index 538451684b3b4c..72e3810757d6a3 100644 --- a/dev/image/Dockerfile +++ b/dev/image/Dockerfile @@ -4,14 +4,14 @@ FROM gitpod/workspace-gitpod-dev:latest -ENV TRIGGER_REBUILD 45 +ENV TRIGGER_REBUILD 46 USER root ### Go ### # Pin Go version explicitly to ensure all CI-built binaries use a -# non-vulnerable toolchain (CVE-2025-68121 requires >= 1.24.13). -ENV GO_VERSION=1.24.13 +# non-vulnerable toolchain (CVE-2026-27143 requires >= 1.25.9). +ENV GO_VERSION=1.25.9 RUN rm -rf /usr/local/go /home/gitpod/go /home/gitpod/.cache/go-build \ && curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" | tar -C /usr/local -xz \ && ln -sf /usr/local/go/bin/go /usr/bin/go \ diff --git a/dev/kubecdl/go.mod b/dev/kubecdl/go.mod index fa19916e5d3890..f4d7544bbbb900 100644 --- a/dev/kubecdl/go.mod +++ b/dev/kubecdl/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/kubecdl go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/loadgen/go.mod b/dev/loadgen/go.mod index fb3fe800648199..cc551fa66999a7 100644 --- a/dev/loadgen/go.mod +++ b/dev/loadgen/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/loadgen go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/preview/previewctl/go.mod b/dev/preview/previewctl/go.mod index edfdab3761ded8..69d22efe9f7dbf 100644 --- a/dev/preview/previewctl/go.mod +++ b/dev/preview/previewctl/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/previewctl go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/rejector/go.mod b/dev/rejector/go.mod index 2b9bffe35c27f5..0d0c6b0bfdfed0 100644 --- a/dev/rejector/go.mod +++ b/dev/rejector/go.mod @@ -2,7 +2,7 @@ module gitpod.io/rejector/v2 go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/ssh-load-test/go.mod b/dev/ssh-load-test/go.mod index d256e7515c35ec..4d06bf37e67d51 100644 --- a/dev/ssh-load-test/go.mod +++ b/dev/ssh-load-test/go.mod @@ -2,7 +2,7 @@ module test go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/dev/version-manifest/go.mod b/dev/version-manifest/go.mod index 25ee8f70cc3b46..f86ec15bac2d06 100644 --- a/dev/version-manifest/go.mod +++ b/dev/version-manifest/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/version-manifest go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/install/installer/go.mod b/install/installer/go.mod index abfd9418518c20..e62121c70f528a 100644 --- a/install/installer/go.mod +++ b/install/installer/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/installer go 1.24.0 -toolchain go1.24.13 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/install/preview/prettylog/go.mod b/install/preview/prettylog/go.mod index 87a2577c80f2d6..ad653eef43562c 100644 --- a/install/preview/prettylog/go.mod +++ b/install/preview/prettylog/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/install/preview/prettylog go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/operations/observability/mixins/go.mod b/operations/observability/mixins/go.mod index 77ae43e362e0cc..bf040cdbdc148c 100644 --- a/operations/observability/mixins/go.mod +++ b/operations/observability/mixins/go.mod @@ -2,7 +2,7 @@ module gitpod-io/mixin-utils go 1.24 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 diff --git a/test/go.mod b/test/go.mod index f5f28718e5886b..e662a4abeeeec6 100644 --- a/test/go.mod +++ b/test/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/test go 1.24.0 -toolchain go1.24.3 +toolchain go1.25.9 godebug tlsmlkem=0 From ef4bc5c045d35b667c23437fea70156dccb677ee Mon Sep 17 00:00:00 2001 From: Gero Posmyk-Leinemann Date: Thu, 23 Apr 2026 06:52:35 +0000 Subject: [PATCH 2/4] Pin golangci-lint --go=1.24 to match CI image toolchain The CI dev-environment image bundles golangci-lint v1.64.8 built with Go 1.24, which refuses to lint code declaring "toolchain go1.25.9". Pin the lint target to 1.24 so the existing image keeps working without a rebuild. We don't use any 1.25 language features; the toolchain bump only addresses CVE-2026-27143 in the Go stdlib. Co-authored-by: Ona --- WORKSPACE.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/WORKSPACE.yaml b/WORKSPACE.yaml index ef2344d89eba17..d03269d389f7c6 100644 --- a/WORKSPACE.yaml +++ b/WORKSPACE.yaml @@ -71,5 +71,9 @@ defaultVariant: [ "sh", "-c", - "golangci-lint run --disable govet,errcheck,staticcheck --allow-parallel-runners --timeout 15m", + # --go=1.24 keeps lint compatible with the v1.64.x golangci-lint built into the + # CI dev-environment image (which is itself built with Go 1.24). Our toolchain bump + # to 1.25.9 only addresses CVE-2026-27143 in the Go stdlib; we don't use any 1.25 + # language features. + "golangci-lint run --go=1.24 --disable govet,errcheck,staticcheck --allow-parallel-runners --timeout 15m", ] From 8c5644166f0f898bf55bc8972f06e5c1cbc69248 Mon Sep 17 00:00:00 2001 From: Gero Posmyk-Leinemann Date: Thu, 23 Apr 2026 07:01:51 +0000 Subject: [PATCH 3/4] Revert toolchain bumps; rely on CI image's system Go for fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit bumped 'toolchain go1.25.9' across all 71 go.mod files. That worked locally but broke the existing CI dev-environment image, which: 1. ships golangci-lint v1.64.8 built with Go 1.24 (rejects modules declaring toolchain >= 1.25) 2. has system Go 1.24.13, so GOTOOLCHAIN=auto downloads the 1.25.9 toolchain module — but that module's prebuilt tools dir lacks 'covdata', breaking 'go test -coverprofile' for any Go library package. Instead, leave the 'toolchain' directive at go1.24.13 and rely on the new dev-environment image (which has system Go 1.25.9 from dev/image/Dockerfile) to compile binaries with the patched stdlib. Once branch CI publishes the new image, a follow-up commit will update the image tag references in .gitpod.yml and the workflow files (same two-step pattern as #21327). Co-authored-by: Ona --- WORKSPACE.yaml | 6 +----- components/blobserve/go.mod | 2 +- components/common-go/go.mod | 2 +- components/content-service-api/go/go.mod | 2 +- components/content-service-api/typescript/util/go.mod | 2 +- components/content-service/go.mod | 2 +- components/docker-up/go.mod | 2 +- components/ee/agent-smith/cmd/testbed/go.mod | 2 +- components/ee/agent-smith/cmd/testtarget/go.mod | 2 +- components/ee/agent-smith/go.mod | 2 +- components/gitpod-cli/go.mod | 2 +- components/gitpod-db/go/go.mod | 2 +- components/gitpod-protocol/go/go.mod | 2 +- components/ide-metrics-api/go.mod | 2 +- components/ide-metrics-api/go/go.mod | 2 +- components/ide-metrics/go.mod | 2 +- components/ide-service-api/go/go.mod | 2 +- components/ide-service/go.mod | 2 +- components/ide/code-desktop/status/go.mod | 2 +- components/ide/code/codehelper/go.mod | 2 +- components/ide/jetbrains/cli/go.mod | 2 +- components/ide/jetbrains/launcher/go.mod | 2 +- components/image-builder-api/go.mod | 2 +- components/image-builder-api/go/go.mod | 2 +- components/image-builder-bob/go.mod | 2 +- components/image-builder-mk3/go.mod | 2 +- components/local-app-api/go.mod | 2 +- components/local-app-api/go/go.mod | 2 +- components/local-app/go.mod | 2 +- components/node-labeler/go.mod | 2 +- components/openvsx-proxy/go.mod | 2 +- components/public-api-server/go.mod | 2 +- components/public-api/go/go.mod | 2 +- components/registry-facade-api/go.mod | 2 +- components/registry-facade-api/go/go.mod | 2 +- components/registry-facade/go.mod | 2 +- components/scrubber/go.mod | 2 +- components/server/go/go.mod | 2 +- components/service-waiter/go.mod | 2 +- components/spicedb/codegen/go.mod | 2 +- components/spicedb/go.mod | 2 +- components/supervisor-api/go.mod | 2 +- components/supervisor-api/go/go.mod | 2 +- components/supervisor/go.mod | 2 +- components/usage-api/go/go.mod | 2 +- components/usage/go.mod | 2 +- components/workspacekit/go.mod | 2 +- components/ws-daemon-api/go.mod | 2 +- components/ws-daemon-api/go/go.mod | 2 +- components/ws-daemon/go.mod | 2 +- components/ws-daemon/nsinsider/go.mod | 2 +- components/ws-daemon/seccomp-profile-installer/go.mod | 2 +- components/ws-manager-api/go.mod | 2 +- components/ws-manager-api/go/go.mod | 2 +- components/ws-manager-bridge-api/go/go.mod | 2 +- components/ws-manager-mk2/go.mod | 2 +- components/ws-proxy/go.mod | 2 +- dev/addlicense/go.mod | 2 +- dev/blowtorch/go.mod | 2 +- dev/changelog/go.mod | 2 +- dev/gp-gcloud/go.mod | 2 +- dev/gpctl/go.mod | 2 +- dev/kubecdl/go.mod | 2 +- dev/loadgen/go.mod | 2 +- dev/preview/previewctl/go.mod | 2 +- dev/rejector/go.mod | 2 +- dev/ssh-load-test/go.mod | 2 +- dev/version-manifest/go.mod | 2 +- install/installer/go.mod | 2 +- install/preview/prettylog/go.mod | 2 +- operations/observability/mixins/go.mod | 2 +- test/go.mod | 2 +- 72 files changed, 72 insertions(+), 76 deletions(-) diff --git a/WORKSPACE.yaml b/WORKSPACE.yaml index d03269d389f7c6..ef2344d89eba17 100644 --- a/WORKSPACE.yaml +++ b/WORKSPACE.yaml @@ -71,9 +71,5 @@ defaultVariant: [ "sh", "-c", - # --go=1.24 keeps lint compatible with the v1.64.x golangci-lint built into the - # CI dev-environment image (which is itself built with Go 1.24). Our toolchain bump - # to 1.25.9 only addresses CVE-2026-27143 in the Go stdlib; we don't use any 1.25 - # language features. - "golangci-lint run --go=1.24 --disable govet,errcheck,staticcheck --allow-parallel-runners --timeout 15m", + "golangci-lint run --disable govet,errcheck,staticcheck --allow-parallel-runners --timeout 15m", ] diff --git a/components/blobserve/go.mod b/components/blobserve/go.mod index 10b77542b2b580..6e85c9b6921f1c 100644 --- a/components/blobserve/go.mod +++ b/components/blobserve/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/blobserve go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/common-go/go.mod b/components/common-go/go.mod index 87c010628ae648..ae1b795f3d5732 100644 --- a/components/common-go/go.mod +++ b/components/common-go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/common-go go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/content-service-api/go/go.mod b/components/content-service-api/go/go.mod index 85da1bffa1988c..c728680f210a82 100644 --- a/components/content-service-api/go/go.mod +++ b/components/content-service-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/content-service/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/content-service-api/typescript/util/go.mod b/components/content-service-api/typescript/util/go.mod index b689e445fa71be..451cef55939c7e 100644 --- a/components/content-service-api/typescript/util/go.mod +++ b/components/content-service-api/typescript/util/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/content-service-api/util go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/content-service/go.mod b/components/content-service/go.mod index 2cf19537eea49f..4fcbe93bda6e37 100644 --- a/components/content-service/go.mod +++ b/components/content-service/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/content-service go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/docker-up/go.mod b/components/docker-up/go.mod index 0c1542b21de774..e3e5d12e6d0c37 100644 --- a/components/docker-up/go.mod +++ b/components/docker-up/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/docker-up go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ee/agent-smith/cmd/testbed/go.mod b/components/ee/agent-smith/cmd/testbed/go.mod index 69f57b5fd329c0..6cea2e2df41c76 100644 --- a/components/ee/agent-smith/cmd/testbed/go.mod +++ b/components/ee/agent-smith/cmd/testbed/go.mod @@ -2,6 +2,6 @@ module testbed go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ee/agent-smith/cmd/testtarget/go.mod b/components/ee/agent-smith/cmd/testtarget/go.mod index c092cc6481dc7f..1a54155a9536e8 100644 --- a/components/ee/agent-smith/cmd/testtarget/go.mod +++ b/components/ee/agent-smith/cmd/testtarget/go.mod @@ -2,6 +2,6 @@ module testtarget go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ee/agent-smith/go.mod b/components/ee/agent-smith/go.mod index 181385959e4464..b7394f8a641060 100644 --- a/components/ee/agent-smith/go.mod +++ b/components/ee/agent-smith/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/agent-smith go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/gitpod-cli/go.mod b/components/gitpod-cli/go.mod index 22da358e0d9d7e..635868af8dd84a 100644 --- a/components/gitpod-cli/go.mod +++ b/components/gitpod-cli/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gitpod-cli go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/gitpod-db/go/go.mod b/components/gitpod-db/go/go.mod index e9c616e0b8589c..dda675fce7c988 100644 --- a/components/gitpod-db/go/go.mod +++ b/components/gitpod-db/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/gitpod-db/go go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/gitpod-protocol/go/go.mod b/components/gitpod-protocol/go/go.mod index 94a6f95a7ee888..647340715eddf6 100644 --- a/components/gitpod-protocol/go/go.mod +++ b/components/gitpod-protocol/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gitpod-protocol go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide-metrics-api/go.mod b/components/ide-metrics-api/go.mod index 37a45f5ab67eeb..41e4d9dc3c57f1 100644 --- a/components/ide-metrics-api/go.mod +++ b/components/ide-metrics-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide-metrics-api/go/go.mod b/components/ide-metrics-api/go/go.mod index 3d91bf5e638127..3c9faa6d1a0b24 100644 --- a/components/ide-metrics-api/go/go.mod +++ b/components/ide-metrics-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-metrics-api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide-metrics/go.mod b/components/ide-metrics/go.mod index 65d73a28380f17..6e5459d657bc8b 100644 --- a/components/ide-metrics/go.mod +++ b/components/ide-metrics/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-metrics go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide-service-api/go/go.mod b/components/ide-service-api/go/go.mod index 150c0e6167a618..2ccac4df8201e9 100644 --- a/components/ide-service-api/go/go.mod +++ b/components/ide-service-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-service-api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide-service/go.mod b/components/ide-service/go.mod index 04a3a5630c2b66..6bdb1f73478f32 100644 --- a/components/ide-service/go.mod +++ b/components/ide-service/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ide-service go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide/code-desktop/status/go.mod b/components/ide/code-desktop/status/go.mod index c71bdd26eebfbf..f59dc6d7e2e573 100644 --- a/components/ide/code-desktop/status/go.mod +++ b/components/ide/code-desktop/status/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/code-desktop/status go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide/code/codehelper/go.mod b/components/ide/code/codehelper/go.mod index 69c29c949c3704..6c7ddd85e4492b 100644 --- a/components/ide/code/codehelper/go.mod +++ b/components/ide/code/codehelper/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/code/codehelper go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide/jetbrains/cli/go.mod b/components/ide/jetbrains/cli/go.mod index 7230eb7849c923..faebb343e4b47f 100644 --- a/components/ide/jetbrains/cli/go.mod +++ b/components/ide/jetbrains/cli/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/jetbrains/cli go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ide/jetbrains/launcher/go.mod b/components/ide/jetbrains/launcher/go.mod index a02c12aed63d50..176b9c874510bc 100644 --- a/components/ide/jetbrains/launcher/go.mod +++ b/components/ide/jetbrains/launcher/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/jetbrains/launcher go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/image-builder-api/go.mod b/components/image-builder-api/go.mod index 37a45f5ab67eeb..41e4d9dc3c57f1 100644 --- a/components/image-builder-api/go.mod +++ b/components/image-builder-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/image-builder-api/go/go.mod b/components/image-builder-api/go/go.mod index edcbbe5785f0a4..cddce28f5bc8e5 100644 --- a/components/image-builder-api/go/go.mod +++ b/components/image-builder-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/image-builder/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/image-builder-bob/go.mod b/components/image-builder-bob/go.mod index 91cedeff7c1282..1055aad842aa3f 100644 --- a/components/image-builder-bob/go.mod +++ b/components/image-builder-bob/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/image-builder/bob go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/image-builder-mk3/go.mod b/components/image-builder-mk3/go.mod index 5fbcb15bcdd623..262eeb6b497d16 100644 --- a/components/image-builder-mk3/go.mod +++ b/components/image-builder-mk3/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/image-builder go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/local-app-api/go.mod b/components/local-app-api/go.mod index 37a45f5ab67eeb..41e4d9dc3c57f1 100644 --- a/components/local-app-api/go.mod +++ b/components/local-app-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/local-app-api/go/go.mod b/components/local-app-api/go/go.mod index b9b5ec12014e49..f8497d60896ca5 100644 --- a/components/local-app-api/go/go.mod +++ b/components/local-app-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/local-app/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/local-app/go.mod b/components/local-app/go.mod index f397234119f75d..601519daa35e67 100644 --- a/components/local-app/go.mod +++ b/components/local-app/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/local-app go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/node-labeler/go.mod b/components/node-labeler/go.mod index b950408b45a4e2..605fe3b8df6450 100644 --- a/components/node-labeler/go.mod +++ b/components/node-labeler/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/node-labeler go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/openvsx-proxy/go.mod b/components/openvsx-proxy/go.mod index be4fb3080d9443..dbc8b834ff334a 100644 --- a/components/openvsx-proxy/go.mod +++ b/components/openvsx-proxy/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/openvsx-proxy go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/public-api-server/go.mod b/components/public-api-server/go.mod index b984c94a64327d..acef6c5ea249a5 100644 --- a/components/public-api-server/go.mod +++ b/components/public-api-server/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/public-api-server go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/public-api/go/go.mod b/components/public-api/go/go.mod index 34e3135bbac0c5..38345b5a4897a8 100644 --- a/components/public-api/go/go.mod +++ b/components/public-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/public-api/go go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/registry-facade-api/go.mod b/components/registry-facade-api/go.mod index 37a45f5ab67eeb..41e4d9dc3c57f1 100644 --- a/components/registry-facade-api/go.mod +++ b/components/registry-facade-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/registry-facade-api/go/go.mod b/components/registry-facade-api/go/go.mod index c014cc96476120..aa410792a28392 100644 --- a/components/registry-facade-api/go/go.mod +++ b/components/registry-facade-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/registry-facade/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/registry-facade/go.mod b/components/registry-facade/go.mod index 8d66ffd48eb13f..31b864eee4f82c 100644 --- a/components/registry-facade/go.mod +++ b/components/registry-facade/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/registry-facade go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/scrubber/go.mod b/components/scrubber/go.mod index ecce6aaf8e12e9..65e28e44d9b84c 100644 --- a/components/scrubber/go.mod +++ b/components/scrubber/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/scrubber go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/server/go/go.mod b/components/server/go/go.mod index 0936a0d6be57d9..5b541f7268d5e6 100644 --- a/components/server/go/go.mod +++ b/components/server/go/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/gitpod/server/go go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/service-waiter/go.mod b/components/service-waiter/go.mod index 3127343c908558..b720de78d6ea53 100644 --- a/components/service-waiter/go.mod +++ b/components/service-waiter/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/service-waiter go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/spicedb/codegen/go.mod b/components/spicedb/codegen/go.mod index af89e7e0441b45..509053ce9c29c4 100644 --- a/components/spicedb/codegen/go.mod +++ b/components/spicedb/codegen/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/spicedb/codegen go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/spicedb/go.mod b/components/spicedb/go.mod index 2da10f671d465a..612387d260862d 100644 --- a/components/spicedb/go.mod +++ b/components/spicedb/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/components/spicedb go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/supervisor-api/go.mod b/components/supervisor-api/go.mod index 37a45f5ab67eeb..41e4d9dc3c57f1 100644 --- a/components/supervisor-api/go.mod +++ b/components/supervisor-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/supervisor-api/go/go.mod b/components/supervisor-api/go/go.mod index 3c7af8b88bead1..aecedd09c9a87c 100644 --- a/components/supervisor-api/go/go.mod +++ b/components/supervisor-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/supervisor/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/supervisor/go.mod b/components/supervisor/go.mod index 0fd2910565e596..2569ae3f4f0fff 100644 --- a/components/supervisor/go.mod +++ b/components/supervisor/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/supervisor go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/usage-api/go/go.mod b/components/usage-api/go/go.mod index 3b43a7ea9a2401..0aeadf12aff3e7 100644 --- a/components/usage-api/go/go.mod +++ b/components/usage-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/usage-api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/usage/go.mod b/components/usage/go.mod index 4b9351b1b1999e..e2553b49c61ae1 100644 --- a/components/usage/go.mod +++ b/components/usage/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/usage go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/workspacekit/go.mod b/components/workspacekit/go.mod index 94ccfca347c191..120ef781e0e7fa 100644 --- a/components/workspacekit/go.mod +++ b/components/workspacekit/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/workspacekit go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-daemon-api/go.mod b/components/ws-daemon-api/go.mod index 37a45f5ab67eeb..41e4d9dc3c57f1 100644 --- a/components/ws-daemon-api/go.mod +++ b/components/ws-daemon-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-daemon-api/go/go.mod b/components/ws-daemon-api/go/go.mod index e0418fd5184269..1b65662232800d 100644 --- a/components/ws-daemon-api/go/go.mod +++ b/components/ws-daemon-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-daemon/go.mod b/components/ws-daemon/go.mod index b68cbfdf23b657..d431c225c648b6 100644 --- a/components/ws-daemon/go.mod +++ b/components/ws-daemon/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-daemon/nsinsider/go.mod b/components/ws-daemon/nsinsider/go.mod index 468f2f54aff7bb..003e02d0028b08 100644 --- a/components/ws-daemon/nsinsider/go.mod +++ b/components/ws-daemon/nsinsider/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon/nsinsider go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-daemon/seccomp-profile-installer/go.mod b/components/ws-daemon/seccomp-profile-installer/go.mod index 1a0324d02f4ace..b9099ee8b97a26 100644 --- a/components/ws-daemon/seccomp-profile-installer/go.mod +++ b/components/ws-daemon/seccomp-profile-installer/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-daemon/seccomp-profile-installer go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-manager-api/go.mod b/components/ws-manager-api/go.mod index 37a45f5ab67eeb..41e4d9dc3c57f1 100644 --- a/components/ws-manager-api/go.mod +++ b/components/ws-manager-api/go.mod @@ -2,6 +2,6 @@ module github.com/gitpod-io/generated_code_dependencies go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-manager-api/go/go.mod b/components/ws-manager-api/go/go.mod index bb2396c1d1f389..d423fe50338bca 100644 --- a/components/ws-manager-api/go/go.mod +++ b/components/ws-manager-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-manager/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-manager-bridge-api/go/go.mod b/components/ws-manager-bridge-api/go/go.mod index d98276df729f4e..85f1f62c84a6a9 100644 --- a/components/ws-manager-bridge-api/go/go.mod +++ b/components/ws-manager-bridge-api/go/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-manager-bridge/api go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-manager-mk2/go.mod b/components/ws-manager-mk2/go.mod index 7f959a08a566f9..6e43c910f16aab 100644 --- a/components/ws-manager-mk2/go.mod +++ b/components/ws-manager-mk2/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-manager-mk2 go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/components/ws-proxy/go.mod b/components/ws-proxy/go.mod index 248b8b0cde0d0b..0bd610c15ba107 100644 --- a/components/ws-proxy/go.mod +++ b/components/ws-proxy/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/ws-proxy go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/addlicense/go.mod b/dev/addlicense/go.mod index 701f3e6757635f..b21d01d031fc3f 100644 --- a/dev/addlicense/go.mod +++ b/dev/addlicense/go.mod @@ -2,7 +2,7 @@ module github.com/google/addlicense go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/blowtorch/go.mod b/dev/blowtorch/go.mod index cf60d2b23a9c4e..92d6862584dd3d 100644 --- a/dev/blowtorch/go.mod +++ b/dev/blowtorch/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/blowtorch go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/changelog/go.mod b/dev/changelog/go.mod index d776424f65783c..a29392322b0cad 100644 --- a/dev/changelog/go.mod +++ b/dev/changelog/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/changelog go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/gp-gcloud/go.mod b/dev/gp-gcloud/go.mod index 1479dad422b306..162f2d56c648be 100644 --- a/dev/gp-gcloud/go.mod +++ b/dev/gp-gcloud/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gp-gcloud go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/gpctl/go.mod b/dev/gpctl/go.mod index 9ee26edfb7fa60..69632d5c430b14 100644 --- a/dev/gpctl/go.mod +++ b/dev/gpctl/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/gpctl go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/kubecdl/go.mod b/dev/kubecdl/go.mod index f4d7544bbbb900..1ce3936a75a359 100644 --- a/dev/kubecdl/go.mod +++ b/dev/kubecdl/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/kubecdl go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/loadgen/go.mod b/dev/loadgen/go.mod index cc551fa66999a7..55426a417590ea 100644 --- a/dev/loadgen/go.mod +++ b/dev/loadgen/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/loadgen go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/preview/previewctl/go.mod b/dev/preview/previewctl/go.mod index 69d22efe9f7dbf..80ebb4945e21d4 100644 --- a/dev/preview/previewctl/go.mod +++ b/dev/preview/previewctl/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/previewctl go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/rejector/go.mod b/dev/rejector/go.mod index 0d0c6b0bfdfed0..fb4070a1fedfe2 100644 --- a/dev/rejector/go.mod +++ b/dev/rejector/go.mod @@ -2,7 +2,7 @@ module gitpod.io/rejector/v2 go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/ssh-load-test/go.mod b/dev/ssh-load-test/go.mod index 4d06bf37e67d51..dd874f6aa02bc7 100644 --- a/dev/ssh-load-test/go.mod +++ b/dev/ssh-load-test/go.mod @@ -2,7 +2,7 @@ module test go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/dev/version-manifest/go.mod b/dev/version-manifest/go.mod index f86ec15bac2d06..80587a63f0b1bf 100644 --- a/dev/version-manifest/go.mod +++ b/dev/version-manifest/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/version-manifest go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/install/installer/go.mod b/install/installer/go.mod index e62121c70f528a..abfd9418518c20 100644 --- a/install/installer/go.mod +++ b/install/installer/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/installer go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/install/preview/prettylog/go.mod b/install/preview/prettylog/go.mod index ad653eef43562c..3a6bc1bb76a359 100644 --- a/install/preview/prettylog/go.mod +++ b/install/preview/prettylog/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/install/preview/prettylog go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/operations/observability/mixins/go.mod b/operations/observability/mixins/go.mod index bf040cdbdc148c..7011710b02f4c0 100644 --- a/operations/observability/mixins/go.mod +++ b/operations/observability/mixins/go.mod @@ -2,7 +2,7 @@ module gitpod-io/mixin-utils go 1.24 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 diff --git a/test/go.mod b/test/go.mod index e662a4abeeeec6..ed612896d2bbf4 100644 --- a/test/go.mod +++ b/test/go.mod @@ -2,7 +2,7 @@ module github.com/gitpod-io/gitpod/test go 1.24.0 -toolchain go1.25.9 +toolchain go1.24.13 godebug tlsmlkem=0 From 60d9240fc670d322b6b4a8dc25bb82a619994d40 Mon Sep 17 00:00:00 2001 From: Gero Posmyk-Leinemann Date: Thu, 23 Apr 2026 09:48:26 +0000 Subject: [PATCH 4/4] Update dev-environment image to ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 This image was published by the previous run of this PR and contains Go 1.25.9, which is needed to compile binaries free of CVE-2026-27143. Switching the workflow and devcontainer references over so subsequent CI runs use the patched toolchain. Co-authored-by: Ona --- .github/workflows/branch-build.yml | 12 ++++++------ .github/workflows/build.yml | 12 ++++++------ .github/workflows/code-nightly.yml | 2 +- .github/workflows/ide-integration-tests.yml | 8 ++++---- .github/workflows/jetbrains-auto-update-template.yml | 2 +- .github/workflows/jetbrains-integration-test.yml | 2 +- .github/workflows/preview-env-check-regressions.yml | 6 +++--- .github/workflows/preview-env-delete.yml | 2 +- .github/workflows/preview-env-gc.yml | 4 ++-- .github/workflows/workspace-integration-tests.yml | 8 ++++---- .gitpod.yml | 2 +- 11 files changed, 30 insertions(+), 30 deletions(-) diff --git a/.github/workflows/branch-build.yml b/.github/workflows/branch-build.yml index 563051e3155122..c32574a1e26d3e 100644 --- a/.github/workflows/branch-build.yml +++ b/.github/workflows/branch-build.yml @@ -112,7 +112,7 @@ jobs: cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }} runs-on: ubuntu-latest-16-cores container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -140,7 +140,7 @@ jobs: (needs.configuration.outputs.is_scheduled_run != 'true') runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure @@ -187,7 +187,7 @@ jobs: ports: - 6379:6379 container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root env: DB_HOST: "mysql" @@ -410,7 +410,7 @@ jobs: if: needs.configuration.outputs.is_scheduled_run != 'true' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install @@ -463,7 +463,7 @@ jobs: environment: branch-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: @@ -492,7 +492,7 @@ jobs: environment: branch-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0e4d81b3041c9b..3540fd57c3825e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -115,7 +115,7 @@ jobs: cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }} runs-on: ubuntu-latest-16-cores container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -143,7 +143,7 @@ jobs: (needs.configuration.outputs.is_scheduled_run != 'true') runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure @@ -190,7 +190,7 @@ jobs: ports: - 6379:6379 container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root env: DB_HOST: "mysql" @@ -448,7 +448,7 @@ jobs: if: needs.configuration.outputs.is_scheduled_run != 'true' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install @@ -501,7 +501,7 @@ jobs: environment: main-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: @@ -530,7 +530,7 @@ jobs: environment: main-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: diff --git a/.github/workflows/code-nightly.yml b/.github/workflows/code-nightly.yml index ef3a98007ffcc8..7d68743b46bd6e 100644 --- a/.github/workflows/code-nightly.yml +++ b/.github/workflows/code-nightly.yml @@ -11,7 +11,7 @@ jobs: build: runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/ide-integration-tests.yml b/.github/workflows/ide-integration-tests.yml index f4f985b3f431ba..2f33f234f953a9 100644 --- a/.github/workflows/ide-integration-tests.yml +++ b/.github/workflows/ide-integration-tests.yml @@ -36,7 +36,7 @@ jobs: name: Configuration runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root outputs: name: ${{ steps.configuration.outputs.name }} @@ -93,7 +93,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -126,7 +126,7 @@ jobs: needs: [configuration, infrastructure] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root volumes: - /var/tmp:/var/tmp @@ -216,7 +216,7 @@ jobs: if: github.event.inputs.skip_delete != 'true' && always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/jetbrains-auto-update-template.yml b/.github/workflows/jetbrains-auto-update-template.yml index be608ad08a3e94..25f43d6c9021f1 100644 --- a/.github/workflows/jetbrains-auto-update-template.yml +++ b/.github/workflows/jetbrains-auto-update-template.yml @@ -15,7 +15,7 @@ jobs: update-jetbrains: runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # pin@v2 diff --git a/.github/workflows/jetbrains-integration-test.yml b/.github/workflows/jetbrains-integration-test.yml index e066d936375c9f..dee8494f308fad 100644 --- a/.github/workflows/jetbrains-integration-test.yml +++ b/.github/workflows/jetbrains-integration-test.yml @@ -34,7 +34,7 @@ on: jobs: jetbrains-smoke-test-linux: container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root runs-on: ubuntu-latest steps: diff --git a/.github/workflows/preview-env-check-regressions.yml b/.github/workflows/preview-env-check-regressions.yml index a77dd7f407c82a..97ac129a6bd2d1 100644 --- a/.github/workflows/preview-env-check-regressions.yml +++ b/.github/workflows/preview-env-check-regressions.yml @@ -60,7 +60,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -93,7 +93,7 @@ jobs: if: ${{ needs.configuration.outputs.skip == 'false' }} runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root volumes: - /var/tmp:/var/tmp @@ -171,7 +171,7 @@ jobs: if: always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/preview-env-delete.yml b/.github/workflows/preview-env-delete.yml index cdcb695ccdb6a5..9920b142a684d5 100644 --- a/.github/workflows/preview-env-delete.yml +++ b/.github/workflows/preview-env-delete.yml @@ -15,7 +15,7 @@ jobs: if: github.event.ref_type == 'branch' || github.event.inputs.name != '' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/preview-env-gc.yml b/.github/workflows/preview-env-gc.yml index 4269c516954556..3275736e33a325 100644 --- a/.github/workflows/preview-env-gc.yml +++ b/.github/workflows/preview-env-gc.yml @@ -11,7 +11,7 @@ jobs: name: "Find stale preview environments" runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root outputs: names: ${{ steps.set-matrix.outputs.names }} @@ -43,7 +43,7 @@ jobs: needs: [stale] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root if: ${{ needs.stale.outputs.count > 0 }} strategy: diff --git a/.github/workflows/workspace-integration-tests.yml b/.github/workflows/workspace-integration-tests.yml index 81e6c2cc894d68..801ab49b5d8adc 100644 --- a/.github/workflows/workspace-integration-tests.yml +++ b/.github/workflows/workspace-integration-tests.yml @@ -52,7 +52,7 @@ jobs: name: Configuration runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root outputs: name: ${{ steps.configuration.outputs.name }} @@ -126,7 +126,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -159,7 +159,7 @@ jobs: needs: [configuration, infrastructure] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -183,7 +183,7 @@ jobs: if: inputs.skip_delete != 'true' && always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.gitpod.yml b/.gitpod.yml index bacd55591fcfbe..46f0569f6a35c8 100644 --- a/.gitpod.yml +++ b/.gitpod.yml @@ -1,4 +1,4 @@ -image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181 +image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:ona-clc-2243-fix-cve-2026-27143-bump-go-gha.275 workspaceLocation: gitpod/gitpod-ws.code-workspace checkoutLocation: gitpod ports: