fix(deps): OADP-7565: bump Go toolchain to 1.25.8 and update x/* dependencies#14
fix(deps): OADP-7565: bump Go toolchain to 1.25.8 and update x/* dependencies#14kaovilai wants to merge 1 commit intomigtools:oadp-devfrom
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughGo module dependency pins updated: Go directive/toolchain set to 1.25.0/ go1.25.8 and multiple direct and indirect module versions bumped (notably OpenTelemetry, golang.org/x/, google.golang.org/). No source code changes outside Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
There was a problem hiding this comment.
Pull request overview
Updates the project’s Go toolchain and golang.org/x/* dependencies to pick up upstream security fixes, primarily via go.mod/go.sum version bumps.
Changes:
- Bump Go toolchain from
go1.25.4togo1.25.8. - Update
golang.org/x/cryptoandgolang.org/x/net(plus related transitivex/*modules) to newer patched versions. - Regenerate
go.sumaccordingly.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Updates the toolchain and golang.org/x/* dependency versions. |
| go.sum | Updates module checksums to match the dependency bumps. |
| module github.com/kopia/kopia | ||
|
|
||
| go 1.25 | ||
| go 1.25.0 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
go.mod (1)
3-5: Optional follow-up: pin CI/build images to Go 1.25.8 as well.To avoid drift between local and CI behavior, ensure pipeline/runtime images are also on
go1.25.8.Also applies to: 61-69
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` around lines 3 - 5, The CI/build images and any runtime Docker/base images need to be pinned to the same Go toolchain version declared in go.mod (toolchain go1.25.8) to avoid drift; update your CI pipeline configs (e.g., GitHub Actions workflows, Dockerfiles, builder images, and any buildkite/tekton templates) to use `golang:1.25.8` (or the equivalent image/tag that matches toolchain go1.25.8) wherever a Go version is specified so the environment matches the go.mod toolchain entry.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@go.mod`:
- Around line 3-5: The CI/build images and any runtime Docker/base images need
to be pinned to the same Go toolchain version declared in go.mod (toolchain
go1.25.8) to avoid drift; update your CI pipeline configs (e.g., GitHub Actions
workflows, Dockerfiles, builder images, and any buildkite/tekton templates) to
use `golang:1.25.8` (or the equivalent image/tag that matches toolchain
go1.25.8) wherever a Go version is specified so the environment matches the
go.mod toolchain entry.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c4d3aa62-449c-4924-9d94-93e0861d2fa2
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## oadp-dev #14 +/- ##
===========================================
Coverage ? 77.93%
===========================================
Files ? 548
Lines ? 31459
Branches ? 0
===========================================
Hits ? 24517
Misses ? 4884
Partials ? 2058 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
kaovilai
changed the title
kaovilai
force-pushed
the
oadp-dev-go1.25.8
branch
from
abd440e to
98a6de0
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 56-59: The OTLP exporter module versions in go.mod are out of sync
with the core OpenTelemetry modules; update
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (and any other
otlp exporter entries) to v1.42.0 to match go.opentelemetry.io/otel,
go.opentelemetry.io/otel/sdk and go.opentelemetry.io/otel/trace; locate the
entries for otlptracegrpc (and other otlp exporter modules) and change their
version strings from v1.38.0 to v1.42.0 so all stable OTel modules have exact
version parity.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3aac446a-a55d-47df-8325-c065268be69d
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
kaovilai
force-pushed
the
oadp-dev-go1.25.8
branch
2 times, most recently
from
f88d5f6 to
ce6825f
Compare
…cies Update Go toolchain from go1.25.4 to go1.25.8 to address multiple CVEs: - GO-2026-4337, GO-2026-4340 (crypto/tls) - GO-2026-4341 (net/url) - GO-2026-4342 (archive/zip) - CVE-2026-25679 (net/url IPv6 host parsing) - CVE-2026-27137 (crypto/x509 email constraints) Update golang.org/x/* dependencies: - x/crypto v0.49.0 (fixes GHSA-j5w8-q4qc-rx2x, GHSA-f6x5-jh6r-wrfv) - x/net v0.52.0 (fixes GHSA-vvgc-356p-c3xw) - x/sys v0.42.0, x/text v0.35.0, x/term v0.41.0, x/sync v0.20.0 Update go.opentelemetry.io/otel/sdk v1.38.0 → v1.42.0 (fixes GHSA-9h8m-3fm2-qjrq: arbitrary code execution via PATH hijacking) Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering>
kaovilai
force-pushed
the
oadp-dev-go1.25.8
branch
from
ce6825f to
2fbd4f5
Compare
Summary
toolchain go1.25.4totoolchain go1.25.8to address multiple CVEsgolang.org/x/cryptoto v0.49.0 andgolang.org/x/netto v0.52.0 for security fixesgo.opentelemetry.io/otel/sdkfrom v1.38.0 to v1.42.0 (fixes GHSA-9h8m-3fm2-qjrq: arbitrary code execution via PATH hijacking)npm audit fixinapp/to resolve npm audit failuresCVEs Addressed
Go Toolchain (1.25.8)
golang.org/x/* Dependencies
Other Vulnerable Dependencies
Jira
Test plan
go build ./...passesNote
Responses generated with Claude
Summary by CodeRabbit