Skip to content

Bump Go to 1.25.8 to fix stdlib CVEs#253

Merged
Shivs11 merged 2 commits intomainfrom
security/bump-go-1.25.8
Apr 1, 2026
Merged

Bump Go to 1.25.8 to fix stdlib CVEs#253
Shivs11 merged 2 commits intomainfrom
security/bump-go-1.25.8

Conversation

@Shivs11
Copy link
Copy Markdown
Member

@Shivs11 Shivs11 commented Mar 31, 2026

Summary

Test plan

  • CI passes with Go 1.25.8
  • After merge, cherry-pick to release/v1.5.1 branch and tag v1.5.1

🤖 Generated with Claude Code

Addresses CVE-2026-25679 (High), CVE-2026-27142 (Medium),
CVE-2026-27139 (Low) in Go stdlib.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@Shivs11 Shivs11 requested review from a team and jlegrone as code owners March 31, 2026 19:45
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown

@jaypipes jaypipes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@Shivs11 Shivs11 merged commit f679471 into main Apr 1, 2026
16 checks passed
@Shivs11 Shivs11 deleted the security/bump-go-1.25.8 branch April 1, 2026 15:29
Shivs11 added a commit that referenced this pull request Apr 1, 2026
## Summary
- Bumps Go version from 1.25.7 to 1.25.8 in `go.mod`
- Fixes CVE-2026-25679 (High), CVE-2026-27142 (Medium), CVE-2026-27139
(Low) in Go stdlib
- Identified via `grype temporalio/temporal-worker-controller:v1.5.0`

## Test plan
- [ ] CI passes with Go 1.25.8
- [ ] After merge, cherry-pick to `release/v1.5.1` branch and tag
`v1.5.1`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants