hanahmily opened a new pull request, #1219: URL: https://github.com/apache/skywalking-banyandb/pull/1219
## Motivation A container/binary image scan (Trivy/Grype-style) flagged a set of CVEs against the built binaries. Triage against the current `main`: - **10 stdlib CVEs** were unfixed — the `go.mod` `go` directive was pinned at `1.25.8`, below the required fix floors (up to `1.25.12`). - `golang.org/x/net` (v0.56.0) and `golang.org/x/crypto` (v0.53.0) were already at or above every listed fix version — nothing to do. - `oras.land/oras-go/v2` and `github.com/containerd/containerd` are **not** dependencies of this project (N/A). These stdlib CVEs are invisible to Dependabot because the Go standard library / toolchain is not a `go.mod`/`go.sum` dependency and therefore isn't in the dependency graph Dependabot scans. ## Changes 1. **Bump `go` directive `1.25.8` → `1.25.12`** — picks up the fixed stdlib toolchain and closes all 10 outstanding stdlib CVEs in one move. With `GOTOOLCHAIN=auto`, CI (`setup-go` via `go-version-file: go.mod`) and the `-plugins` Docker builder resolve to ≥1.25.12 automatically. 2. **Wire the existing `make vuln-check` (govulncheck) target into CI** as a dedicated parallel `vuln-check` job (only `needs: [prepare]`), added to the final `result` gate. This fills the Dependabot gap: govulncheck sees the stdlib/toolchain and does reachability analysis, so it catches future toolchain/dependency CVE regressions without flagging unreachable noise. 3. Update the `plugins/README.md` ABI/toolchain-lock note to `1.25.12`. ## Verification (local) - `make build` (UI + all Go binaries) — pass, compiled with go1.25.12 - `make lint` — 0 issues, ran on go1.25.12 - `make format` + `make tidy` — no drift (go.mod tidy-clean at 1.25.12) - `make vuln-check` — 0 reachable vulnerabilities -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
