From 7859183304afdc9a234bb9d3ff4bc2565849fcac Mon Sep 17 00:00:00 2001 From: Sourya Vatsyayan Date: Fri, 31 Jul 2026 19:53:59 +0530 Subject: [PATCH] security: pin toolchain to go1.25.12 to fix stdlib CVEs Every advisory flagged for this repo in the Jul 2026 dependency scan is a Go stdlib issue -- 1 CRITICAL and 12 HIGH, all against the declared go 1.25.3. Pinning the toolchain clears all 13. CRITICAL: CVE-2025-68121 (9.1) unexpected session resumption in crypto/tls (fix 1.24.13 / 1.25.7) HIGH (12): CVE-2026-39822, CVE-2025-61729, CVE-2025-61726, CVE-2026-25679, CVE-2026-32283, CVE-2026-32281, CVE-2026-32280, CVE-2026-33814, CVE-2026-39836, CVE-2026-42499, CVE-2026-33811, CVE-2026-39820. go1.25.12 is the current 1.25 patch and satisfies every fix line above. CVE-2026-39822 is the binding constraint: its fix is exactly 1.25.12, so nothing lower would clear the full set. The go directive is left at 1.25.3 -- it expresses the minimum language version and does not need to move. Only the toolchain is pinned, which is what determines the stdlib actually compiled in. CI already installed the newest 1.25.x, so in practice CI builds were not vulnerable; the exposure was the declared floor, which is what the scanner reads and what any local or release build without an explicit pin would honour. Also bumps golang.org/x/text v0.33.0 -> v0.39.0 for GO-2026-5970, which was reachable (command/auth/status/status.go:94 -> fmt.Fprintln -> norm.Form.Properties). Not in the scan, but reachable and free to fix. govulncheck: 0 reachable vulnerabilities. Verified: go build, go vet, and the full test suite pass. Co-Authored-By: Claude Opus 5 (1M context) --- go.mod | 4 +++- go.sum | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c1f61db67..4dc5b7043 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/deepsourcelabs/cli go 1.25.3 +toolchain go1.25.12 + require ( github.com/AlecAivazis/survey/v2 v2.3.7 github.com/MakeNowJust/heredoc v1.0.0 @@ -41,6 +43,6 @@ require ( github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect golang.org/x/sys v0.40.0 // indirect golang.org/x/term v0.39.0 // indirect - golang.org/x/text v0.33.0 // indirect + golang.org/x/text v0.39.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index 51fdb1ff9..e01604eda 100644 --- a/go.sum +++ b/go.sum @@ -173,8 +173,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= -golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= -golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= +golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= +golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=