wankai123 opened a new pull request, #13951:
URL: https://github.com/apache/skywalking/pull/13951
### Fix Go e2e test-fixture CVE Dependabot alerts (`golang.org/x/net` + Go
stdlib)
These CVEs come only from the e2e **Go demo test fixtures**
(`test/e2e-v2/cases/go/service`, shared by the go/pprof/profiling-trace cases,
and `test/e2e-v2/cases/profiling/ebpf/network`). They are CI-only fixtures
compiled into throwaway test containers — **never shipped in any OAP artifact**
(the OAP server is Java). This follows the same test-fixture alert-clearing
precedent as #13915.
**`golang.org/x/net` `0.48.0` → `0.55.0`** — clears CVE-2026-25681,
CVE-2026-27136, CVE-2026-33814, CVE-2026-39821.
**Go toolchain `1.24` → `1.26.5`** — clears CVE-2026-27145 and
CVE-2026-42504 (fixed in 1.26.4) and CVE-2026-39822 (fixed in 1.26.5). The
`skywalking-go` base image pins `GOTOOLCHAIN=local`, so the `go` directive
cannot exceed the image's toolchain. This is enabled by the fresh
`skywalking-go` commit `7544822`, whose `-go1.26` image is built `FROM
golang:1.26` = **go1.26.5**:
- both fixture `go.mod`: `go 1.24.0` → `go 1.26.5` (+ `go mod
tidy`-reconciled transitives x/crypto/x/sys/x/text)
- both Dockerfiles: base image `-go1.24` → `-go1.26`
- `SW_AGENT_GO_COMMIT` → `7544822` (`script/env` + the `Dockerfile.service`
default ARG)
The new `SW_AGENT_GO_COMMIT` is a workflow-only skywalking-go commit
("Support workflow dispatch to push docker image"), so agent instrumentation is
unchanged and the eBPF-network e2e expected traces are untouched.
Both fixture images were verified building locally with go1.26.5 + the
skywalking-go agent (`docker compose build go-service`; `docker build -f
Dockerfile.service .../network/`).
Note: the netty
(CVE-2026-42577/-42579/-42583/-42584/-42587/-44249/-44893/-45416/-45674/-47691/-48059/-50010)
and jackson-databind (CVE-2026-54512/-54513) alerts from the same scan are
already remediated on `master` by #13944 (netty `4.2.15.Final`,
jackson-databind `2.18.8`); no change needed here.
- [ ] Add a unit test to verify that the fix works. (N/A —
dependency/toolchain version bump in CI-only test fixtures; verified via local
fixture image builds and covered by the existing go + eBPF-network e2e suites.)
- [x] Explain briefly why the bug exists and how to fix it.
- [ ] If this pull request closes/resolves/fixes an existing issue, replace
the issue number. Closes #<issue number>.
- [x] Update the [`CHANGES`
log](https://github.com/apache/skywalking/blob/master/docs/en/changes/changes.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
