Ethan-Xingyue opened a new issue, #1154: URL: https://github.com/apache/incubator-seata-go/issues/1154
| Field | Value | | --- | --- | | Issue title | `[BUG] [Security][Dependencies] govulncheck reports 9 reachable vulnerabilities in 6 dependencies; CI still builds with Go 1.20.14` | | Labels (exist in repo) | `bug`, `ci/cd` | | Suggested priority | P0 (release blocker candidate) | | Related | #603 "security: dependency security vulnerability" (open, 2023 snapshot). Option: post this as an update comment on #603 instead of a new issue. | | Verification | Scan run 2026-09-02 on master `3bf73586`; [email protected], vuln DB updated 2026-08-28 | | Disclosure note | Everything below comes from public Go vulnerability advisories. Do not add exploit details to the public issue. | --- ## 🚀 Go Version Host: go1.24.3 darwin/arm64. `[email protected]` requires go >= 1.25, so the scan ran with the auto-selected go1.26.8 toolchain. ## 📦 Seata-go Version master, commit 3bf73586af81db1bd428982c93d82000d80cb1c8 (fetched 2026-09-02) ## 💾 Operating System macOS ## 📝 Bug Description `govulncheck ./...` on current master reports **9 vulnerabilities from 6 third-party modules that are reachable from seata-go code** (the scanner prints a call stack from a seata-go package to the vulnerable symbol for each one). It also lists 14 vulnerabilities in imported packages and 24 in required modules that do not appear to be reachable. Minimum fixed versions reported by the scanner (lower bounds; re-scan after the actual MVS result): | Module | Current (`go.mod`) | Fixed in (max of reported) | Advisories | Note | | --- | --- | --- | --- | --- | | `github.com/jackc/pgx/v5` | v5.4.3 (L20) | v5.9.2 | GO-2026-5004, GO-2024-2606, GO-2024-2567 | SQL injection via placeholder / dollar-quoted strings; panic in Pipeline. Reached from `pkg/datasource/sql/xa/postgres_xa_connection.go` | | `google.golang.org/grpc` | v1.57.0 (L31) | v1.82.1 | GO-2026-6061 | xDS RBAC / HTTP/2 transport server | | `google.golang.org/protobuf` | v1.31.0 (L42) | v1.33.0 | GO-2024-2611 | infinite loop in JSON unmarshaling | | `golang.org/x/net` | v0.23.0 (L127, indirect) | v0.55.0 | GO-2026-5026, GO-2026-4918 | idna / HTTP/2 SETTINGS_MAX_FRAME_SIZE infinite loop | | `golang.org/x/text` | v0.14.0 (L112, indirect) | v0.39.0 | GO-2026-5970 | infinite loop on invalid input | | `github.com/gorilla/websocket` | v1.4.2 (L71, indirect) | v1.5.3 | GO-2026-6278 | weak PRNG for WebSocket mask key. Reached from `pkg/discovery/naming_server.go` and `pkg/remoting/getty/getty_remoting.go` | **Go baseline.** `.github/workflows/unit-test.yml` pins Go `1.20.14` with `actions/setup-go@v3` (https://github.com/apache/incubator-seata-go/blob/3bf73586af81db1bd428982c93d82000d80cb1c8/.github/workflows/unit-test.yml#L36-L42). Go supports only the two most recent major releases (https://go.dev/doc/devel/release#policy); Go 1.20 stopped receiving security fixes when Go 1.22 shipped in February 2024. Standard-library findings therefore depend on the toolchain a release is built with; the 9 findings above are third-party modules only and are independent of the toolchain. Neither `govulncheck` nor a supported-Go matrix is a CI gate today, so this drift is silent. Suggested priority: P0 for the next release (pgx SQL injection is on the PostgreSQL XA path; gRPC/HTTP2, protobuf and WebSocket are on network boundaries). ## 🔄 Steps to Reproduce ```bash git clone https://github.com/apache/incubator-seata-go.git cd incubator-seata-go git checkout 3bf73586af81db1bd428982c93d82000d80cb1c8 go run golang.org/x/vuln/cmd/[email protected] -version go run golang.org/x/vuln/cmd/[email protected] ./... echo "exit=$?" ``` Exit code 3 means "vulnerabilities found", not a build failure. ## ✅ Expected Behavior - `govulncheck ./...` reports no reachable vulnerabilities, or every remaining finding has a written, time-boxed risk acceptance with owner and mitigation. - Release builds and CI use a supported Go release line (stable + oldstable at the time), and the minimum supported Go version is declared. - A `govulncheck` gate in CI prevents the next drift. ## ❌ Actual Behavior Excerpt of the scan output (full output attached separately if needed): ```text Go: go1.26.8 Scanner: [email protected] DB: https://vuln.go.dev DB updated: 2026-08-28 14:47:45 +0000 UTC Vulnerability #1: GO-2026-6278 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket More info: https://pkg.go.dev/vuln/GO-2026-6278 Module: github.com/gorilla/websocket Found in: github.com/gorilla/[email protected] Fixed in: github.com/gorilla/[email protected] Example traces found: #1: pkg/discovery/naming_server.go:858:16: discovery.NamingServerClient.Close calls sync.Once.Do, which eventually calls websocket.Conn.Close Vulnerability #2: GO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc More info: https://pkg.go.dev/vuln/GO-2026-6061 Module: google.golang.org/grpc Found in: google.golang.org/[email protected] Fixed in: google.golang.org/[email protected] Example traces found: #1: pkg/remoting/grpc/pb/grpcMessage_grpc.pb.go:81:34: pb.seataServiceSendRequestClient.Recv calls grpc.clientStream.RecvMsg, which eventually calls transport.controlBuffer.executeAndPut Vulnerability #3: GO-2026-5970 Infinite loop on invalid input in golang.org/x/text More info: https://pkg.go.dev/vuln/GO-2026-5970 Module: golang.org/x/text Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Example traces found: #1: pkg/discovery/naming_server.go:843:2: discovery.NamingServerClient.Watch calls http2.transportResponseBody.Close, which eventually calls norm.Form.Bytes Vulnerability #4: GO-2026-5026 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna More info: https://pkg.go.dev/vuln/GO-2026-5026 Module: golang.org/x/net Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Example traces found: #1: pkg/discovery/naming_server.go:843:2: discovery.NamingServerClient.Watch calls http2.transportResponseBody.Close, which eventually calls idna.ToASCII Vulnerability #5: GO-2026-5004 SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx More info: https://pkg.go.dev/vuln/GO-2026-5004 Module: github.com/jackc/pgx/v5 Found in: github.com/jackc/pgx/[email protected] Fixed in: github.com/jackc/pgx/[email protected] Example traces found: #1: pkg/datasource/sql/xa/postgres_xa_connection.go:190:32: xa.PostgresXAConn.Recover calls stdlib.Conn.QueryContext, which eventually calls sanitize.SanitizeSQL Vulnerability #6: GO-2026-4918 Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net More info: https://pkg.go.dev/vuln/GO-2026-4918 Module: golang.org/x/net Found in: golang.org/x/[email protected] Fixed in: golang.org/x/[email protected] Example traces found: #1: pkg/discovery/naming_server.go:843:2: discovery.NamingServerClient.Watch calls http2.transportResponseBody.Close, which eventually calls http2.clientConnReadLoop.processSettingsNoWrite Vulnerability #7: GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf More info: https://pkg.go.dev/vuln/GO-2024-2611 Module: google.golang.org/protobuf Found in: google.golang.org/[email protected] Fixed in: google.golang.org/[email protected] Example traces found: #1: pkg/saga/statemachine/engine/expr/cel_expression.go:77:34: expr.CELExpression.Value calls cel.prog.Eval, which eventually calls json.Decoder.Peek Vulnerability #8: GO-2024-2606 SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx More info: https://pkg.go.dev/vuln/GO-2024-2606 Module: github.com/jackc/pgx/v5 Found in: github.com/jackc/pgx/[email protected] Fixed in: github.com/jackc/pgx/[email protected] Example traces found: #1: pkg/datasource/sql/db.go:220:44: sql.DBResource.ConnectionForXA calls stdlib.driverConnector.Connect, which eventually calls pgconn.ConnectConfig Vulnerability #9: GO-2024-2567 Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx More info: https://pkg.go.dev/vuln/GO-2024-2567 Module: github.com/jackc/pgx/v5 Found in: github.com/jackc/pgx/[email protected] Fixed in: github.com/jackc/pgx/[email protected] Example traces found: #1: pkg/datasource/sql/xa/postgres_xa_connection.go:190:32: xa.PostgresXAConn.Recover calls stdlib.Conn.QueryContext, which eventually calls pgconn.Pipeline.Sync Your code is affected by 9 vulnerabilities from 6 modules. This scan also found 14 vulnerabilities in packages you import and 24 vulnerabilities in modules you require, but your code doesn't appear to call these vulnerabilities. exit status 3 ``` ## 💡 Possible Solution - Do the dependency upgrade in its own PR, separate from feature work: bump the Go baseline first, then pgx >= 5.9.2, grpc >= 1.82.1, protobuf >= 1.33.0, x/net >= 0.55.0, x/text >= 0.39.0, gorilla/websocket >= 1.5.3, then re-scan on the final `go.mod`/`go.sum`. - CI matrix on current stable and oldstable Go (replace `actions/setup-go@v3`); whether Go 1.20 stays supported is a PPMC decision that should be stated in release notes. - Add `govulncheck ./...` as a release gate, plus periodic dependency updates and an SBOM. - Upgrade acceptance must include Getty/gRPC wire tests, MySQL/PostgreSQL AT/XA end-to-end tests and the Saga protobuf/CEL tests, not just a successful build. - If a finding is proven unreachable, record the call-chain analysis and an expiry date instead of ignoring it permanently. Acceptance criteria: - [ ] CI runs on a supported Go matrix and the minimum supported version is documented. - [ ] After the upgrade, `govulncheck` reports zero reachable findings, or the exceptions are documented with an expiry. - [ ] Unit, race, vet and Getty/gRPC wire tests pass. - [ ] MySQL/PostgreSQL AT/XA and Saga end-to-end tests pass. - [ ] SBOM and scan output are stored with the release. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
