security: Go 1.25.12 + cilium/xz patch bumps (4 of 10 fixable CVEs)#295
Merged
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go builder version in the Dockerfile from 1.25.11 to 1.25.12 and upgrades several direct and indirect dependencies in go.mod and go.sum, including packages from Cilium, Docker, Prometheus, and Kubernetes. I have no feedback to provide as there are no review comments to assess.
Trivy on ghcr.io/nudgebee/node-agent:0.1.3 shows 0/4/6 fixable in the agent binary. This clears the bump-safe set: - GO_VERSION 1.25.11 -> 1.25.12: CVE-2026-39822 (HIGH, os.Root symlink traversal) + CVE-2026-42505 (crypto/tls ECH) - github.com/cilium/cilium v1.17.15 -> v1.17.16 (1 MEDIUM; a listed fixed version on the 1.17 line) - github.com/ulikunitz/xz v0.5.14 -> v0.5.15 (1 MEDIUM) NOT cleared — each needs a migration, not a bump: - prometheus/prometheus (4 CVEs, fix >=0.305/0.311): those releases require client-go >=0.35, which cilium 1.17 cannot compile against (RetryOnError removed from cache.Config), and cilium 1.18/1.19 removed pkg/maps/lbmap that containers/cilium.go uses to parse the HOST's cilium BPF maps — bumping the lib types risks misreading maps of older deployed ciliums. Needs a deliberate lbmap-parsing migration with host-version compat analysis. - docker/docker (CVE-2026-34040 HIGH / CVE-2026-33997): fix is 29.3.1, but moby has no v29 tags on the github.com/docker/docker import path — v29 ships as the split github.com/moby/moby/* modules; needs an import migration. Verified in the Dockerfile's exact builder environment (debian:bullseye + libsystemd-dev, CGO_ENABLED=1, Go 1.25.12): go build ./... and go vet ./... clean (go.sum tidied on linux — a darwin tidy prunes linux-only entries and breaks CI).
mayankpande88
force-pushed
the
security/go-1.25.12-dep-bumps
branch
from
July 17, 2026 04:40
27f3400 to
f2b520e
Compare
mayankpande88
changed the title
blue4209211
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Trivy on
ghcr.io/nudgebee/node-agent:0.1.3(CI scan run nudgebee/nudgebee 29551177314) shows 0/4/6 fixable in the agent binary. This PR clears the bump-safe set:GO_VERSION1.25.11 → 1.25.12cilium/cilium→ v1.17.16 (a listed fixed version on the 1.17 line)ulikunitz/xz→ v0.5.15Not cleared — each is a migration, not a bump (verified, not assumed)
RetryOnErrorremoved fromcache.Config) — and cilium 1.18/1.19 removedpkg/maps/lbmap, whichcontainers/cilium.gouses to parse the host's cilium BPF maps. Bumping the lib types risks misreading maps of older deployed ciliums, so this needs a deliberate lbmap-parsing migration with host-version compatibility analysis. (Attempted the full cascade: prometheus 0.311 + apiextensions 0.35 + cilium 1.19 →pkg/maps/lbmapimport breaks; details reproducible from the attempt logs.)github.com/docker/dockerimport path — v29 ships as the splitgithub.com/moby/moby/*modules; needs an import-path migration.Residual image posture after this: the prometheus 4 + docker 2 (migrations above) + the UBI9 NOFIX floor (0/16/85, no upstream fix; shrinks via the existing
microdnf updatelayer).How Has This Been Tested?
go build ./...+go vet ./...clean in the Dockerfile's exact builder environment (debian:bullseye, libsystemd-dev, CGO_ENABLED=1, Go 1.25.12)