Update Go version from 1.25.7 to 1.26.1 to address CVEs#213
Update Go version from 1.25.7 to 1.26.1 to address CVEs#213Preethi-Ps wants to merge 2 commits intooperator-framework:mainfrom
Conversation
need 1.26.1. version to fix CVE-2026-25679,CVE-2026-27139,CVE-2026-27142 Signed-off-by: Preethi-Ps <nannetpreethi@gmail.com>
|
@acornett21 - just a gentle nudge on this PR — would appreciate your review when you have time. Thanks! |
|
Hi @Preethi-Ps, Currently there are no downstream builder images for 1.26, or anything higher then 1.25.7. When there is projects in OperatorFramework will update to higher go versions. |
|
@Preethi-Ps I know we are still waiting on other things (as per the comment from Adam above), but since you have this PR open, I was wondering if it would possible to change the go version to |
Signed-off-by: Preethi-Ps <nannetpreethi@gmail.com>
|
@darrentma Thanks for highlighting this. I’ve updated the Go version to 1.26.2 in this PR to incorporate the fixes for the recently published high severity CVEs. Please let me know if any further changes are needed. |
This PR closes issues:
CVE-2026-25679,
CVE-2026-27139,
CVE-2026-27142
Description of the change:
Updated the Go version from 1.25.7 to 1.26.1 in go.mod to use a more recent and secure Go toolchain.
Motivation for the change:
Fix multiple CVEs linked in the above issues
/cc @chiragkyal
/cc @acornett21