Skip to content

Update Go version from 1.25.7 to 1.26.1 to address CVEs#213

Open
Preethi-Ps wants to merge 2 commits intooperator-framework:mainfrom
Preethi-Ps:patch-1
Open

Update Go version from 1.25.7 to 1.26.1 to address CVEs#213
Preethi-Ps wants to merge 2 commits intooperator-framework:mainfrom
Preethi-Ps:patch-1

Conversation

@Preethi-Ps
Copy link
Copy Markdown

@Preethi-Ps Preethi-Ps commented Mar 26, 2026

This PR closes issues:

CVE-2026-25679,
CVE-2026-27139,
CVE-2026-27142

Description of the change:
Updated the Go version from 1.25.7 to 1.26.1 in go.mod to use a more recent and secure Go toolchain.

Motivation for the change:
Fix multiple CVEs linked in the above issues

/cc @chiragkyal
/cc @acornett21

need 1.26.1. version to fix CVE-2026-25679,CVE-2026-27139,CVE-2026-27142

Signed-off-by: Preethi-Ps <nannetpreethi@gmail.com>
@Preethi-Ps
Copy link
Copy Markdown
Author

@acornett21 - just a gentle nudge on this PR — would appreciate your review when you have time. Thanks!

@acornett21
Copy link
Copy Markdown
Contributor

Hi @Preethi-Ps, Currently there are no downstream builder images for 1.26, or anything higher then 1.25.7. When there is projects in OperatorFramework will update to higher go versions.

@darrentma
Copy link
Copy Markdown

@Preethi-Ps I know we are still waiting on other things (as per the comment from Adam above), but since you have this PR open, I was wondering if it would possible to change the go version to 1.26.2 (or 1.25.9). Several high sev CVEs were published on April 8 that are fixed in 1.26.2 / 1.25.9. (eg. CVE-2026-32281, CVE-2026-25679) . Thanks!

Signed-off-by: Preethi-Ps <nannetpreethi@gmail.com>
@Preethi-Ps
Copy link
Copy Markdown
Author

@darrentma Thanks for highlighting this. I’ve updated the Go version to 1.26.2 in this PR to incorporate the fixes for the recently published high severity CVEs. Please let me know if any further changes are needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants