Alkapuce opened a new pull request, #1168: URL: https://github.com/apache/incubator-seata-go/pull/1168
- [x] I have registered the PR [changes](https://github.com/apache/incubator-seata-go/tree/master/changes). **What this PR does**: This PR addresses the reachable dependency vulnerabilities reported in #1154. - Upgrade the affected Go dependencies, including pgx, gRPC, protobuf, x/net, x/text, and gorilla/websocket. - Raise the minimum supported Go version to 1.26.8 and update CI to test Go 1.26.8 and 1.27.1. - Add a govulncheck and CycloneDX SBOM workflow, together with Dependabot configuration. - Update CI and lint configurations for the supported toolchain. - Fix compatibility and integration-test issues exposed by the dependency and toolchain upgrades. - Record the change in `changes/dev.md` and `changes/dev_zh.md`. **Which issue(s) this PR fixes**: Fixes #1154 **Special notes for your reviewer**: Issue #1154 links the earlier dependency security report in #603. This PR addresses the current reachable findings and adds continuous CI detection. The scope is limited to dependency security remediation, supported Go/toolchain updates, CI security checks, and the compatibility or test changes required by those updates. No new transaction feature is introduced. Local verification completed successfully: - `go build ./...` - `go test ./... -race -timeout 10m` - `go vet ./...` - `GOOS=linux GOARCH=riscv64 go build ./...` - `go mod verify` - `[email protected] ./...` with 0 reachable vulnerabilities - Incremental GolangCI-Lint with 0 new issues - AT/TCC/Saga integration tests with exit code 0 **Does this PR introduce a user-facing change?**: ```release-note action required: The minimum supported Go version is now 1.26.8. Users building or embedding seata-go must use Go 1.26.8 or newer. ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
