This is an automated email from the ASF dual-hosted git repository.
hanahmily pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/skywalking-banyandb.git
The following commit(s) were added to refs/heads/main by this push:
new 32055eb1a chore(security): bump Go toolchain to 1.25.12 and add
govulncheck CI job (#1219)
32055eb1a is described below
commit 32055eb1a069a8c6ab93b5e7de5bb72e7bf7dec0
Author: Gao Hongtao <[email protected]>
AuthorDate: Thu Jul 16 13:54:06 2026 +0800
chore(security): bump Go toolchain to 1.25.12 and add govulncheck CI job
(#1219)
* chore(security): bump Go toolchain to 1.25.12 and wire govulncheck into CI
Bump the go.mod go directive from 1.25.8 to 1.25.12 to pick up the fixed
stdlib toolchain and close all outstanding stdlib CVEs (fix floors up to
1.25.12). x/net (v0.56.0) and x/crypto (v0.53.0) were already patched.
Wire the existing `make vuln-check` (govulncheck) target into the CI
pipeline as a dedicated parallel job so stdlib/toolchain and dependency
CVE regressions are caught going forward. Dependabot does not track the
Go stdlib/toolchain, so govulncheck fills that gap with reachability
analysis.
* test(schema): de-flake clamp multi-group query on group2 topology race
The "clips TimeRange.Begin to max(CreatedAt)" spec created group2 and only
waited via AwaitRevision, which confirms the schema cache but not that
group2's topology has propagated to the distributed query coordinator. The
final multi-group query could then fire before group2 resolved and fail
with "group not found" (STATUS_INTERNAL_ERROR).
Wrap the query in gm.Eventually, retrying only on error — matching the
single-group baseline retry already in this spec. Retrying on error (not on
emptiness) keeps the clamp assertion falsifiable: a genuine regression still
surfaces as a non-empty successful response.
---
.github/workflows/ci.yml | 21 ++++++++++++++++++++-
go.mod | 2 +-
plugins/README.md | 2 +-
test/cases/schema/clamp.go | 46 ++++++++++++++++++++++++++++------------------
4 files changed, 50 insertions(+), 21 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c9c14598..991f35718 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,6 +89,25 @@ jobs:
run: make license-dep
- name: Check
run: make check
+ vuln-check:
+ name: Vulnerability Scan
+ runs-on: ubuntu-latest
+ needs: [prepare]
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+ - name: Setup build environment
+ uses: ./.github/actions/setup-build-env
+ with:
+ download-artifacts: 'true'
+ setup-docker: 'false'
+ - name: Cache Tools
+ uses: actions/cache@v4
+ with:
+ path: bin
+ key: ${{ runner.os }}-generate-tool-${{ hashFiles('**/version.mk') }}
+ - name: Run govulncheck (stdlib + dependency CVEs)
+ run: make vuln-check
detect_fodc_e2e_changes:
name: Detect FODC E2E Changes
runs-on: ubuntu-latest
@@ -165,6 +184,6 @@ jobs:
name: Continuous Integration
runs-on: ubuntu-24.04
needs:
- [detect_fodc_e2e_changes, test-banyand, test-bydbctl, test-fodc,
test-fodc-e2e, test-pkg, test-integration-standalone,
test-integration-distributed, e2e]
+ [vuln-check, detect_fodc_e2e_changes, test-banyand, test-bydbctl,
test-fodc, test-fodc-e2e, test-pkg, test-integration-standalone,
test-integration-distributed, e2e]
steps:
- run: echo 'success'
diff --git a/go.mod b/go.mod
index 50b8fed1e..717e60ab1 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
module github.com/apache/skywalking-banyandb
-go 1.25.8
+go 1.25.12
require (
cloud.google.com/go/storage v1.63.0
diff --git a/plugins/README.md b/plugins/README.md
index 609d2c384..8ba0483a2 100644
--- a/plugins/README.md
+++ b/plugins/README.md
@@ -55,7 +55,7 @@ func main() {} // required by
-buildmode=plugin
A Go plugin is loaded via `plugin.Open`, which requires the `.so` and the
host process to share the **exact same**:
-- Go toolchain version (this repo pins `go 1.25.8` via `go.mod`;
`GOTOOLCHAIN=auto`
+- Go toolchain version (this repo pins `go 1.25.12` via `go.mod`;
`GOTOOLCHAIN=auto`
resolves it identically in CI, in the `-plugins` Docker builder stage, and
in a local `make build-plugins`),
- `pkg/pipeline/sdk` package build (and its full transitive module graph),
diff --git a/test/cases/schema/clamp.go b/test/cases/schema/clamp.go
index 2e113bdd7..bdfa2e00b 100644
--- a/test/cases/schema/clamp.go
+++ b/test/cases/schema/clamp.go
@@ -283,25 +283,35 @@ var _ = g.Describe("Schema time-range clamp", func() {
"CreatedAt2 must be strictly after T_data1 for the
falsification to be meaningful")
g.By("Querying group1+group2 with Begin far before T_data1 —
clamp forwards Begin to CreatedAt2 > T_data1, excluding the datum")
- queryResp, queryErr := clients.MeasureWriteClient.Query(ctx,
&measurev1.QueryRequest{
- Groups: []string{group1, group2},
- Name: measureName,
- TimeRange: &modelv1.TimeRange{
- Begin:
timestamppb.New(tData1.Add(-time.Hour).Truncate(time.Millisecond)),
- End:
timestamppb.New(time.Now().Add(time.Hour).Truncate(time.Millisecond)),
- },
- GroupModRevisions: map[string]int64{group1: r1, group2:
r2},
- TagProjection: &modelv1.TagProjection{
- TagFamilies: []*modelv1.TagProjection_TagFamily{
- {Name: "default", Tags:
[]string{"host"}},
+ // In distributed mode the newly created group2 topology can
still race the
+ // query fan-out even after AwaitRevision confirms the schema
cache — the
+ // coordinator transiently reports "group not found". Retry
until the query
+ // resolves, then assert the clamp excludes the pre-creation
datum. Mirrors
+ // the single-group baseline retry above. Retrying only on
error is safe: a
+ // genuine clamp regression surfaces as a non-empty successful
response.
+ var queryResp *measurev1.QueryResponse
+ gm.Eventually(func() error {
+ var queryErr error
+ queryResp, queryErr =
clients.MeasureWriteClient.Query(ctx, &measurev1.QueryRequest{
+ Groups: []string{group1, group2},
+ Name: measureName,
+ TimeRange: &modelv1.TimeRange{
+ Begin:
timestamppb.New(tData1.Add(-time.Hour).Truncate(time.Millisecond)),
+ End:
timestamppb.New(time.Now().Add(time.Hour).Truncate(time.Millisecond)),
},
- },
- FieldProjection:
&measurev1.QueryRequest_FieldProjection{
- Names: []string{"value"},
- },
- Limit: 100,
- })
- gm.Expect(queryErr).ShouldNot(gm.HaveOccurred())
+ GroupModRevisions: map[string]int64{group1: r1,
group2: r2},
+ TagProjection: &modelv1.TagProjection{
+ TagFamilies:
[]*modelv1.TagProjection_TagFamily{
+ {Name: "default", Tags:
[]string{"host"}},
+ },
+ },
+ FieldProjection:
&measurev1.QueryRequest_FieldProjection{
+ Names: []string{"value"},
+ },
+ Limit: 100,
+ })
+ return queryErr
+ }, 10*time.Second,
200*time.Millisecond).ShouldNot(gm.HaveOccurred())
gm.Expect(queryResp.GetDataPoints()).Should(gm.BeEmpty(),
"Rule 7 clamp invariant: T_data1 < CreatedAt2 must be
excluded by the clamp; without clamp the datum would leak")
