From a3a9c8150251d9ad80e4f65cddef90c74e7cf9f0 Mon Sep 17 00:00:00 2001 From: Kevin Seiter Date: Wed, 22 Jul 2026 11:49:03 -0400 Subject: [PATCH] =?UTF-8?q?fix(security):=20[Project=20Darkstar]=20remedia?= =?UTF-8?q?te=20CVE-2026-33814,=20CVE-2026-33811,=20CVE-2026-39820,=20CVE-?= =?UTF-8?q?2026-42499,=20CVE-2026-42504,=20CVE-2026-27145=20=E2=80=94=20up?= =?UTF-8?q?date=20go-toolset=20to=201.25.11?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses 6 Go stdlib CVEs (all Important, CVSS 7.5) from PSHP-558. Bumps go-toolset from 1.25.9/1.25 to 1.25.11 in Containerfile.external-dns-operator, Dockerfile, and drift-cache/Dockerfile. Adds toolchain go1.25.11 directive to go.mod. CVEs fixed in go1.25.10: CVE-2026-33814, CVE-2026-33811, CVE-2026-39820, CVE-2026-42499. CVEs fixed in go1.25.11: CVE-2026-42504, CVE-2026-27145. Ref: PSHP-558 Project Darkstar — automated CVE remediation (contact: Kevin Seiter) --- Containerfile.external-dns-operator | 2 +- Dockerfile | 2 +- drift-cache/Dockerfile | 2 +- go.mod | 2 ++ 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Containerfile.external-dns-operator b/Containerfile.external-dns-operator index f73d565f..6ae3fb24 100644 --- a/Containerfile.external-dns-operator +++ b/Containerfile.external-dns-operator @@ -9,7 +9,7 @@ COPY Dockerfile . RUN test "$(sha1sum Dockerfile.cached | cut -d' ' -f1)" = "$(sha1sum Dockerfile | cut -d' ' -f1)" -FROM registry.access.redhat.com/ubi9/go-toolset:1.25.9-1778675823 as builder +FROM registry.access.redhat.com/ubi9/go-toolset:1.25.11 as builder # dummy copy to trigger the drift detection COPY --from=drift /app/Dockerfile.cached . WORKDIR /workspace diff --git a/Dockerfile b/Dockerfile index 3b7cbd0f..c50ead38 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Build the manager binary -FROM registry.access.redhat.com/ubi9/go-toolset:1.25 as builder +FROM registry.access.redhat.com/ubi9/go-toolset:1.25.11 as builder WORKDIR /opt/app-root/src COPY . . diff --git a/drift-cache/Dockerfile b/drift-cache/Dockerfile index 3b7cbd0f..c50ead38 100644 --- a/drift-cache/Dockerfile +++ b/drift-cache/Dockerfile @@ -1,5 +1,5 @@ # Build the manager binary -FROM registry.access.redhat.com/ubi9/go-toolset:1.25 as builder +FROM registry.access.redhat.com/ubi9/go-toolset:1.25.11 as builder WORKDIR /opt/app-root/src COPY . . diff --git a/go.mod b/go.mod index 7a72056f..3f48ec5e 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/openshift/external-dns-operator go 1.25.0 +toolchain go1.25.11 + require ( github.com/Azure/azure-sdk-for-go v60.1.0+incompatible github.com/Azure/go-autorest/autorest v0.11.27