This is an automated email from the ASF dual-hosted git repository.
wankai123 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/skywalking.git
The following commit(s) were added to refs/heads/master by this push:
new f9edc58aef Clear Go e2e test-fixture CVE Dependabot alerts (x/net + Go
stdlib) (#13951)
f9edc58aef is described below
commit f9edc58aef0b5eb50fd5dd477010f55156651858
Author: Wan Kai <[email protected]>
AuthorDate: Thu Jul 16 14:38:51 2026 +0800
Clear Go e2e test-fixture CVE Dependabot alerts (x/net + Go stdlib) (#13951)
---
docs/en/changes/changes.md | 1 +
test/e2e-v2/cases/go/service/Dockerfile | 2 +-
test/e2e-v2/cases/go/service/go.mod | 10 +++++-----
test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service | 4 ++--
test/e2e-v2/cases/profiling/ebpf/network/go.mod | 8 ++++----
test/e2e-v2/script/env | 2 +-
6 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md
index 96a9800e99..f762cba9ad 100644
--- a/docs/en/changes/changes.md
+++ b/docs/en/changes/changes.md
@@ -326,6 +326,7 @@
* Migrate the Consul cluster and configuration client from the abandoned
`com.orbitz.consul:consul-client` `1.5.3` to the maintained fork
`org.kiwiproject:consul-client` `0.9.0` to clear the okhttp CVE the old client
carried (CVE-2021-0341; the old client pinned okhttp `3.14.9`, fixed in okhttp
`4.9.2+`), so the BOM now pins okhttp to `4.12.0`. The fork's `0.9.x` line is
the last one built for JDK 11 (which SkyWalking still targets); `1.0.0+` is
compiled to JDK 17 bytecode, so the migrat [...]
* Bump test-scope assertj-core `3.20.2` → `3.27.7` to clear CVE-2026-24400
(XXE in `isXmlEqualTo`, not used by any test).
* Clear three security alerts: bump the Airflow e2e mock's pinned `protobuf`
`4.25.8` → `5.29.6` (with `opentelemetry-proto` `1.24.0` → `1.28.0`, whose
`protobuf<5.0` cap was the blocker, and `grpcio` `1.62.2` → `1.63.2`, required
because `opentelemetry-proto` `1.28.0`'s gRPC stubs call
`unary_unary(_registered_method=...)`) to clear CVE-2026-0994 — a CI-only test
fixture, never shipped; and widen the cumulative `count` accumulator from `int`
to `long` in `SumHistogramPercentileFunction` [...]
+* Clear Dependabot CVE alerts in the e2e Go test fixtures (`cases/go/service`
and `cases/profiling/ebpf/network`, CI-only, never shipped in any OAP
artifact): bump `golang.org/x/net` `0.48.0` → `0.55.0` (CVE-2026-25681,
CVE-2026-27136, CVE-2026-33814, CVE-2026-39821) and move the Go toolchain from
`1.24` to `1.26.5` (CVE-2026-27145 / CVE-2026-42504 fixed in 1.26.4,
CVE-2026-39822 fixed in 1.26.5) by switching the shared `skywalking-go` base
image to the `-go1.26` variant and bumping `SW_ [...]
* Fix: continuous profiling policy validation now rejects a threshold / count
of `0` to match the error messages and rover's `value >= threshold` trigger
semantics (a `0` threshold would always trigger). CPU percent and HTTP error
rate are tightened from `[0-100]` to `(0-100]`.
* Fix wrong BanyanDB resource options in record data.
* Align the default BanyanDB stage `segmentInterval` values so each coarser
stage is an integer multiple of the finer one (`records` cold `3` → `4`,
`metricsMinute` cold `5` → `6`, `metricsHour` warm `7` → `10` and cold `15` →
`20`), keeping hot → warm → cold lifecycle migration on the cheap whole-segment
fast path.
diff --git a/test/e2e-v2/cases/go/service/Dockerfile
b/test/e2e-v2/cases/go/service/Dockerfile
index 204518df49..b6365df925 100644
--- a/test/e2e-v2/cases/go/service/Dockerfile
+++ b/test/e2e-v2/cases/go/service/Dockerfile
@@ -14,7 +14,7 @@
# limitations under the License.
ARG SW_AGENT_GO_COMMIT=
-FROM ghcr.io/apache/skywalking-go/skywalking-go:${SW_AGENT_GO_COMMIT}-go1.24
as base
+FROM ghcr.io/apache/skywalking-go/skywalking-go:${SW_AGENT_GO_COMMIT}-go1.26
as base
ENV CGO_ENABLED=0
ENV GO111MODULE=on
diff --git a/test/e2e-v2/cases/go/service/go.mod
b/test/e2e-v2/cases/go/service/go.mod
index dfa4071c86..8d8ad3b6f6 100644
--- a/test/e2e-v2/cases/go/service/go.mod
+++ b/test/e2e-v2/cases/go/service/go.mod
@@ -17,7 +17,7 @@
module sw-e2e
-go 1.24.0
+go 1.26.5
require (
github.com/apache/skywalking-go v0.6.1-0.20251023090254-afa75a3cc8c3
@@ -53,10 +53,10 @@ require (
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
github.com/ugorji/go/codec v1.2.12 // indirect
golang.org/x/arch v0.8.0 // indirect
- golang.org/x/crypto v0.46.0 // indirect
- golang.org/x/net v0.48.0 // indirect
- golang.org/x/sys v0.39.0 // indirect
- golang.org/x/text v0.32.0 // indirect
+ golang.org/x/crypto v0.51.0 // indirect
+ golang.org/x/net v0.55.0 // indirect
+ golang.org/x/sys v0.45.0 // indirect
+ golang.org/x/text v0.37.0 // indirect
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 //
indirect
google.golang.org/grpc v1.79.3 // indirect
google.golang.org/protobuf v1.36.10 // indirect
diff --git a/test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service
b/test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service
index 19050c883c..37153f5137 100644
--- a/test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service
+++ b/test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service
@@ -17,8 +17,8 @@
# Default keeps the generic "Build test image" CI step (which passes no
# build-args) working; keep it in sync with SW_AGENT_GO_COMMIT in
# test/e2e-v2/script/env.
-ARG SW_AGENT_GO_COMMIT=19a9fa9bf058329281aa611f176cf5b7e5cbda8f
-FROM ghcr.io/apache/skywalking-go/skywalking-go:${SW_AGENT_GO_COMMIT}-go1.24
as base
+ARG SW_AGENT_GO_COMMIT=754482220284b9c59d9e48c7f3cf943362eec41d
+FROM ghcr.io/apache/skywalking-go/skywalking-go:${SW_AGENT_GO_COMMIT}-go1.26
as base
ENV CGO_ENABLED=0
ENV GO111MODULE=on
diff --git a/test/e2e-v2/cases/profiling/ebpf/network/go.mod
b/test/e2e-v2/cases/profiling/ebpf/network/go.mod
index 9642f88084..4d6fd2e524 100644
--- a/test/e2e-v2/cases/profiling/ebpf/network/go.mod
+++ b/test/e2e-v2/cases/profiling/ebpf/network/go.mod
@@ -17,7 +17,7 @@
module test
-go 1.24.0
+go 1.26.5
require github.com/apache/skywalking-go v0.6.1-0.20251023090254-afa75a3cc8c3
@@ -29,9 +29,9 @@ require (
github.com/pierrec/lz4/v4 v4.1.15 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/segmentio/kafka-go v0.4.43 // indirect
- golang.org/x/net v0.48.0 // indirect
- golang.org/x/sys v0.39.0 // indirect
- golang.org/x/text v0.32.0 // indirect
+ golang.org/x/net v0.55.0 // indirect
+ golang.org/x/sys v0.45.0 // indirect
+ golang.org/x/text v0.37.0 // indirect
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 //
indirect
google.golang.org/grpc v1.79.3 // indirect
google.golang.org/protobuf v1.36.10 // indirect
diff --git a/test/e2e-v2/script/env b/test/e2e-v2/script/env
index 32fc063bd1..9b12f69ef3 100644
--- a/test/e2e-v2/script/env
+++ b/test/e2e-v2/script/env
@@ -17,7 +17,7 @@ SW_AGENT_JAVA_COMMIT=ac0df43d7140e726eba9e5e5b1b75cf364c71dff
SW_AGENT_SATELLITE_COMMIT=ea27a3f4e126a24775fe12e2aa2695bcb23d99c3
SW_AGENT_NGINX_LUA_COMMIT=c3cee4841798a147d83b96a10914d4ac0e11d0aa
SW_AGENT_NODEJS_COMMIT=36df516f737bfc665dab7312703d826f9dcf527e
-SW_AGENT_GO_COMMIT=19a9fa9bf058329281aa611f176cf5b7e5cbda8f
+SW_AGENT_GO_COMMIT=754482220284b9c59d9e48c7f3cf943362eec41d
SW_AGENT_PYTHON_COMMIT=b91ebc46010ba6a46b251d4df54190c3b64f2db8
SW_AGENT_CLIENT_JS_COMMIT=f08776d909eb1d9bc79c600e493030651b97e491
SW_AGENT_CLIENT_JS_TEST_COMMIT=4f1eb1dcdbde3ec4a38534bf01dded4ab5d2f016
