Skip to content

CSPL-4153: Update dependencies to fix security vulnerabilities#1809

Merged
gabrielm-splunk merged 3 commits intodevelopfrom
cspl-4153-update-dependencies
Apr 8, 2026
Merged

CSPL-4153: Update dependencies to fix security vulnerabilities#1809
gabrielm-splunk merged 3 commits intodevelopfrom
cspl-4153-update-dependencies

Conversation

@gabrielm-splunk
Copy link
Copy Markdown
Collaborator

@gabrielm-splunk gabrielm-splunk commented Apr 1, 2026

Summary

Updates dependencies to address security vulnerabilities identified in VULN tickets.

Changes

  • google.golang.org/grpc: v1.78.0 → v1.79.3 (Fixes VULN-67797 - CVE-2026-33186)
  • github.com/buger/jsonparser: v1.1.1 → v1.1.2 (Fixes VULN-67794)
  • Go stdlib: 1.25.7 → 1.25.8 (Fixes VULN-65734)
  • gnutls: Updated via explicit microdnf update in Dockerfile (Fixes VULN-69140)
  • Other dependencies updated to latest compatible versions via go get -u

Testing

  • Unit tests passing (running)
  • GitLab smoke tests pending
  • GitLab integration tests pending
  • Container scan pending

Next Steps

  • Wait for unit tests to complete
  • Trigger GitLab CI/CD with container scan enabled
  • Verify all VULN tickets are resolved in container scan results

Related Issues

  • Fixes: CSPL-4153
  • Resolves: VULN-67797, VULN-67794, VULN-65734, VULN-69140

🤖 Generated with Claude Code

@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

gabrielm-splunk commented Apr 1, 2026

✅ Unit Tests Passed

All unit tests completed successfully:

  • Test Suite: PASSED
  • Coverage: 97.3% of statements
  • Composite Coverage: 83.5% of statements

🔍 Container Scan Pipeline Triggered

@kasiakoziol kasiakoziol self-requested a review April 2, 2026 05:53
kasiakoziol
kasiakoziol reviewed Apr 2, 2026
View reviewed changes
kasiakoziol
kasiakoziol requested changes Apr 2, 2026
View reviewed changes
@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

gabrielm-splunk commented Apr 3, 2026

✅ Go Version Updated in All Locations

Updated additional Go version references as requested:

Files Updated:

  • ✅ : GO_VERSION=1.25.8
  • ✅ Dockerfile.distroless: FROM golang:1.25.8

Verification:

  • All three Dockerfiles now use Go 1.25.8
  • GitHub workflows reference GO_VERSION from .env (automatically updated)
  • Comprehensive search confirms no remaining 1.25.7 references (except historical changelog)

Changes pushed in: 269658b

Ready for re-review! 🚀

gabrielm-splunk and others added 2 commits April 2, 2026 23:10
@gabrielm-splunk @claude
CSPL-4153: Update dependencies to fix security vulnerabilities
f4e3bd4 
- Update google.golang.org/grpc from v1.78.0 to v1.79.3 (VULN-67797)
- Update github.com/buger/jsonparser from v1.1.1 to v1.1.2 (VULN-67794)
- Update Go stdlib from 1.25.7 to 1.25.8 (VULN-65734)
- Update gnutls via explicit microdnf update (VULN-69140)
- Update other dependencies to latest compatible versions

Fixes: VULN-67797, VULN-67794, VULN-65734, VULN-69140

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Gabriel Mendoza <gabrielm@splunk.com>
@gabrielm-splunk @claude
Update Go version in .env and Dockerfile.distroless
5a463a1 
- Update GO_VERSION in .env: 1.25.7 → 1.25.8
- Update Dockerfile.distroless FROM golang:1.25.7 → 1.25.8

Addresses review comment to update all Go version occurrences.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Gabriel Mendoza <gabrielm@splunk.com>
@gabrielm-splunk gabrielm-splunk force-pushed the cspl-4153-update-dependencies branch from 269658b to 5a463a1 Compare April 3, 2026 03:19
@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

gabrielm-splunk commented Apr 3, 2026

🔄 Commits Updated

Force-pushed to clean up commit history with proper author name and DCO signoff for GitLab compatibility.

All changes remain the same:

  • ✅ Go 1.25.8 in all locations (go.mod, Dockerfile, Dockerfile.distroless, .env)
  • ✅ grpc v1.79.3
  • ✅ jsonparser v1.1.2
  • ✅ gnutls update

Ready for re-review!

@kasiakoziol kasiakoziol self-requested a review April 3, 2026 05:18
rlieberman-splunk
rlieberman-splunk reviewed Apr 7, 2026
View reviewed changes
@gabrielm-splunk
Update UBI 8 minimal base image to 8.10-1775152441
e522e6f 
- Updated Dockerfile: ARG BASE_IMAGE_VERSION
- Updated Makefile: comment and BASE_IMAGE_VERSION variable
- Latest version pulled from registry.access.redhat.com/ubi8/ubi-minimal:8.10

Addresses review comment on PR #1809

Signed-off-by: Gabriel Mendoza <gabmendo@splunk.com>
@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

gabrielm-splunk commented Apr 7, 2026

✅ UBI Base Image Updated

Updated to latest UBI 8 minimal base image as requested:

Changes:

  • Dockerfile: ARG BASE_IMAGE_VERSION=8.10-1775152441 (was 8.10-1770223153)
  • Makefile: Updated comment and BASE_IMAGE_VERSION variable

Verification:

docker pull registry.access.redhat.com/ubi8/ubi-minimal:8.10
# release: 1775152441 (built 2026-04-02)

All instances of the old version have been updated. Ready for re-review! 🚀

@gabrielm-splunk gabrielm-splunk merged commit db4ee06 into develop Apr 8, 2026
56 of 57 checks passed
@gabrielm-splunk gabrielm-splunk deleted the cspl-4153-update-dependencies branch April 8, 2026 16:42
@github-actions github-actions bot locked and limited conversation to collaborators Apr 8, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@rlieberman-splunk rlieberman-splunk rlieberman-splunk approved these changes

@kasiakoziol kasiakoziol kasiakoziol approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@gabrielm-splunk @rlieberman-splunk @kasiakoziol