1fanwang opened a new pull request, #71582:
URL: https://github.com/apache/airflow/pull/71582
The Go SDK job fails on `govulncheck`, which reports seven reachable standard
library advisories:
```
Vulnerability #1: GO-2026-6218
Avoid quadratic complexity in resolvePath in net/url
Standard library
Found in: net/[email protected]
Fixed in: net/[email protected]
```
All seven are already fixed in go1.25.13, which has been stable on go.dev
since
today. CI never gets it: `go-version: 1.25` resolves through the
`actions/go-versions` manifest, and that manifest tops out at 1.25.12. It was
last updated on 2026-07-08 and has no pending update, so the job stays red
for
weeks after every Go security release.
`check-latest: true` makes setup-go resolve the pin against go.dev instead
of the
cached manifest, still picking the newest `1.25` patch. The pinned minor is
unchanged, so `check-go-version-in-sync` and the go.mod relationship both
hold.
Only the two workflows that run the scan are touched.
# Testing Done
| # | Scenario | Result |
|---|---|---|
| 1 | `govulncheck ./...` on go1.25.12, the version CI resolves today | 7
reachable stdlib advisories |
| 2 | `govulncheck ./...` on go1.25.13, the version `check-latest` selects |
No vulnerabilities found |
| 3 | `check-go-version-in-sync` prek hook | Consistent across all 8 pin
sites |
| 4 | Workflow hooks: yamllint, zizmor, amd/arm sync | Passed |
<details><summary>Raw logs</summary>
Red, from the failing job on go1.25.12:
```console
$ govulncheck ./...
=== Symbol Results ===
Vulnerability #1: GO-2026-6218 Found in: net/[email protected] Fixed in:
net/[email protected]
Vulnerability #2: GO-2026-6091 Found in: html/[email protected] Fixed in:
html/[email protected]
Vulnerability #3: GO-2026-6090 Found in: crypto/[email protected] Fixed in:
crypto/[email protected]
Vulnerability #4: GO-2026-6089 Found in: net/[email protected] Fixed in:
net/[email protected]
```
Green, same module and same govulncheck v1.6.0, on go1.25.13:
```console
$ go version
go version go1.25.13 darwin/arm64
$ govulncheck ./...
=== Symbol Results ===
No vulnerabilities found.
Your code is affected by 0 vulnerabilities.
```
Version pinning stays consistent:
```console
$ uv run --project scripts python scripts/ci/prek/check_go_version_in_sync.py
OK: Go version is consistently 1.25 across all 8 pin sites.
$ prek run --files .github/workflows/ci-amd.yml .github/workflows/ci-arm.yml
--stage pre-commit
Check ci-arm.yml and ci-amd.yml stay in
sync.............................Passed
Check Go toolchain version is consistent across build
files..............Passed
Check YAML files with
yamllint...........................................Passed
Run zizmor to check for github workflow syntax
errors....................Passed
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
