Skip to content

CSPL-4153: Update dependencies to fix security vulnerabilities#1809

Open
gabrielm-splunk wants to merge 2 commits intodevelopfrom
cspl-4153-update-dependencies
Open

CSPL-4153: Update dependencies to fix security vulnerabilities#1809
gabrielm-splunk wants to merge 2 commits intodevelopfrom
cspl-4153-update-dependencies

Conversation

@gabrielm-splunk
Copy link
Copy Markdown
Collaborator

Summary

Updates dependencies to address security vulnerabilities identified in VULN tickets.

Changes

  • google.golang.org/grpc: v1.78.0 → v1.79.3 (Fixes VULN-67797 - CVE-2026-33186)
  • github.com/buger/jsonparser: v1.1.1 → v1.1.2 (Fixes VULN-67794)
  • Go stdlib: 1.25.7 → 1.25.8 (Fixes VULN-65734)
  • gnutls: Updated via explicit microdnf update in Dockerfile (Fixes VULN-69140)
  • Other dependencies updated to latest compatible versions via go get -u

Testing

  • Unit tests passing (running)
  • GitLab smoke tests pending
  • GitLab integration tests pending
  • Container scan pending

Next Steps

  • Wait for unit tests to complete
  • Trigger GitLab CI/CD with container scan enabled
  • Verify all VULN tickets are resolved in container scan results

Related Issues

  • Fixes: CSPL-4153
  • Resolves: VULN-67797, VULN-67794, VULN-65734, VULN-69140

🤖 Generated with Claude Code

@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

Unit Tests Passed

All unit tests completed successfully:

  • Test Suite: PASSED
  • Coverage: 97.3% of statements
  • Composite Coverage: 83.5% of statements

🔍 Container Scan Pipeline Triggered

@kasiakoziol kasiakoziol self-requested a review April 2, 2026 05:53
@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

Go Version Updated in All Locations

Updated additional Go version references as requested:

Files Updated:

  • ✅ : GO_VERSION=1.25.8
  • Dockerfile.distroless: FROM golang:1.25.8

Verification:

  • All three Dockerfiles now use Go 1.25.8
  • GitHub workflows reference GO_VERSION from .env (automatically updated)
  • Comprehensive search confirms no remaining 1.25.7 references (except historical changelog)

Changes pushed in: 269658b

Ready for re-review! 🚀

gabrielm-splunk and others added 2 commits April 2, 2026 23:10
- Update google.golang.org/grpc from v1.78.0 to v1.79.3 (VULN-67797)
- Update github.com/buger/jsonparser from v1.1.1 to v1.1.2 (VULN-67794)
- Update Go stdlib from 1.25.7 to 1.25.8 (VULN-65734)
- Update gnutls via explicit microdnf update (VULN-69140)
- Update other dependencies to latest compatible versions

Fixes: VULN-67797, VULN-67794, VULN-65734, VULN-69140

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Gabriel Mendoza <gabrielm@splunk.com>
- Update GO_VERSION in .env: 1.25.7 → 1.25.8
- Update Dockerfile.distroless FROM golang:1.25.7 → 1.25.8

Addresses review comment to update all Go version occurrences.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Gabriel Mendoza <gabrielm@splunk.com>
@gabrielm-splunk gabrielm-splunk force-pushed the cspl-4153-update-dependencies branch from 269658b to 5a463a1 Compare April 3, 2026 03:19
@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

🔄 Commits Updated

Force-pushed to clean up commit history with proper author name and DCO signoff for GitLab compatibility.

All changes remain the same:

  • ✅ Go 1.25.8 in all locations (go.mod, Dockerfile, Dockerfile.distroless, .env)
  • ✅ grpc v1.79.3
  • ✅ jsonparser v1.1.2
  • ✅ gnutls update

Ready for re-review!

@kasiakoziol kasiakoziol self-requested a review April 3, 2026 05:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants