Skip to content

fix(security): remediate CVE vulnerabilities#27

Merged
ulucinar merged 1 commit into
release-0.3from
fix/cve-remediation-release-0.3-20260521-223649
May 21, 2026
Merged

fix(security): remediate CVE vulnerabilities#27
ulucinar merged 1 commit into
release-0.3from
fix/cve-remediation-release-0.3-20260521-223649

Conversation

@upbound-bot

Copy link
Copy Markdown

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
CVE-2026-39820 High stdlib (go1.25.9) go1.25.10
CVE-2026-42499 High stdlib (go1.25.9) go1.25.10
CVE-2026-39836 High stdlib (go1.25.9) go1.25.10
CVE-2026-33814 High stdlib (go1.25.9) go1.25.10
CVE-2026-33811 High stdlib (go1.25.9) go1.25.10
CVE-2026-42501 High stdlib (go1.25.9) go1.25.10
CVE-2026-39817 Medium stdlib (go1.25.9) go1.25.10
CVE-2026-39826 Medium stdlib (go1.25.9) go1.25.10
CVE-2026-39825 Medium stdlib (go1.25.9) go1.25.10
CVE-2026-39823 Medium stdlib (go1.25.9) go1.25.10
CVE-2026-39819 Medium stdlib (go1.25.9) go1.25.10

Changes Made

  • Updated `go` directive in `go.mod` from 1.25.9 to 1.25.10
  • Updated `GO_VERSION` in `.github/workflows/ci.yml` from 1.25.9 to 1.25.10
  • Ran `go mod tidy` to update dependencies

References

Verification

  • Rescanned with `cve-scan` skill after fixes
  • All listed vulnerabilities resolved

- Update Go version to 1.25.10 (fixes CVE-2026-39820, CVE-2026-42499,
  CVE-2026-39836, CVE-2026-33814, CVE-2026-33811, CVE-2026-42501,
  CVE-2026-39817, CVE-2026-39826, CVE-2026-39825, CVE-2026-39823,
  CVE-2026-39819)
- Update CI workflow Go version to 1.25.10

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
@ulucinar ulucinar merged commit a43c394 into release-0.3 May 21, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants