Skip to content

Commit a8b5ef8

Browse files
richardwoodingclaude
richardwooding
and
claude
authored
feat: upgrade to Go 1.25.5 and fix 21 security vulnerabilities (#96)
* feat: upgrade to Go 1.25.5 and fix 21 security vulnerabilities This PR upgrades the project from Go 1.24.0 to Go 1.25.5 and updates golang.org/x/crypto from v0.37.0 to v0.45.0, fixing all 21 security vulnerabilities detected by OSV Scanner. Vulnerabilities Fixed: - 16 Go stdlib vulnerabilities (GO-2025-3563, GO-2025-3749, GO-2025-3750, GO-2025-3751, GO-2025-3849, GO-2025-3956, GO-2025-4007, GO-2025-4008, GO-2025-4009, GO-2025-4010, GO-2025-4011, GO-2025-4012, GO-2025-4013, GO-2025-4014, GO-2025-4155, GO-2025-4175) - 3 golang.org/x/crypto vulnerabilities: * GO-2025-4135 (CVE-2025-47914): SSH Agent message size validation * GO-2025-4134 (CVE-2025-58181): SSH GSSAPI unbounded memory * GO-2025-4116 (CVE-2025-47913): SSH client panic on SSHAGENTSUCCESS - 2 uncalled stdlib vulnerabilities (GO-2025-4006, GO-2025-4015) Changes: - go.mod: Update go directive from 1.24.0 to 1.25.5 - go.mod: Update golang.org/x/crypto from v0.37.0 to v0.45.0 - Updated all GitHub Actions workflows to use Go 1.25.x - CI matrix now tests against Go 1.24.x and 1.25.x for compatibility - All tests pass with 92.1% coverage References: - Go 1.25 Release: https://go.dev/blog/go1.25 - GO-2025-4135: https://pkg.go.dev/vuln/GO-2025-4135 - GO-2025-4134: https://pkg.go.dev/vuln/GO-2025-4134 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]> * fix: update golangci-lint to v2.6 for Go 1.25 support The linting job was failing because golangci-lint v2.2.1 was built with Go 1.24 and cannot lint projects targeting Go 1.25.5. Changes: - Update golangci-lint-action from v7 to v9 - Update golangci-lint version from v2.2.1 to v2.6 golangci-lint v2.6 is built with Go 1.25 and can successfully lint Go 1.25.5 projects. References: - golangci/golangci-lint#5873 - https://github.com/golangci/golangci-lint-action 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]> * chore: Remove Go 1.24.x support and fix perfsprint linting errors - Remove Go 1.24.x from CI test matrix (only Go 1.25.x required now) - Fix perfsprint linting errors in benchmark_test.go and output_length_test.go by replacing string concatenation in loops with strings.Builder This completes the Go 1.25.5 upgrade by removing backward compatibility with Go 1.24.x, which is no longer needed since go.mod requires 1.25.5. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]> --------- Co-authored-by: Claude Sonnet 4.5 <[email protected]>
1 parent beab19b commit a8b5ef8

File tree

10 files changed

+41
-34
lines changed

10 files changed

+41
-34
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616
strategy:
1717
matrix:
18-
go-version: ['1.23.x', '1.24.x'] # Include 1.23 as fallback
18+
go-version: ['1.25.x'] # Go 1.25.5+ required
1919
steps:
2020
- name: Checkout code
2121
uses: actions/checkout@v4
@@ -40,7 +40,7 @@ jobs:
4040
run: go test -race -coverprofile=coverage.out -covermode=atomic -v ./...
4141

4242
- name: Upload coverage to Codecov
43-
if: matrix.go-version == '1.24.x' # Only upload once
43+
if: matrix.go-version == '1.25.x' # Only upload once
4444
uses: codecov/codecov-action@v4
4545
with:
4646
file: ./coverage.out
@@ -59,7 +59,7 @@ jobs:
5959
- name: Set up Go
6060
uses: actions/setup-go@v5
6161
with:
62-
go-version: '1.24.x'
62+
go-version: '1.25.x'
6363
cache: true
6464
check-latest: true
6565

‎.github/workflows/dependency-update.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
- name: Set up Go
2121
uses: actions/setup-go@v5
2222
with:
23-
go-version: '1.23.x' # Use stable version for dependency updates
23+
go-version: '1.25.x' # Use stable version for dependency updates
2424
cache: true
2525
check-latest: true
2626

‎.github/workflows/fuzz.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
- name: Set up Go
2929
uses: actions/setup-go@v5
3030
with:
31-
go-version: '1.24'
31+
go-version: '1.25'
3232
cache: true
3333

3434
- name: Download dependencies
@@ -83,7 +83,7 @@ jobs:
8383
- name: Set up Go
8484
uses: actions/setup-go@v5
8585
with:
86-
go-version: '1.24'
86+
go-version: '1.25'
8787
cache: true
8888

8989
- name: Download dependencies

‎.github/workflows/golangci-lint.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,12 @@ jobs:
2626
- name: Set up Go
2727
uses: actions/setup-go@v5
2828
with:
29-
go-version: '1.24.x' # Match project requirements
29+
go-version: '1.25.x' # Match project requirements
3030
cache: false
3131
check-latest: true
3232

3333
- name: golangci-lint
34-
uses: golangci/golangci-lint-action@v7
34+
uses: golangci/golangci-lint-action@v9
3535
with:
36-
version: v2.2.1
36+
version: v2.6
3737
args: --timeout=5m

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
- name: Set up Go
2222
uses: actions/setup-go@v5
2323
with:
24-
go-version: '1.23.x' # Use stable version for releases
24+
go-version: '1.25.x' # Use stable version for releases
2525
cache: true
2626
check-latest: true
2727

‎.github/workflows/security.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
- name: Set up Go
2424
uses: actions/setup-go@v5
2525
with:
26-
go-version: '1.24.x' # Use version that matches code requirements
26+
go-version: '1.25.x' # Use version that matches code requirements
2727
cache: true
2828
check-latest: true
2929

@@ -44,7 +44,7 @@ jobs:
4444
- name: Set up Go
4545
uses: actions/setup-go@v5
4646
with:
47-
go-version: '1.24.x' # Use version that matches code requirements
47+
go-version: '1.25.x' # Use version that matches code requirements
4848
cache: true
4949
check-latest: true
5050

@@ -65,7 +65,7 @@ jobs:
6565
- name: Set up Go
6666
uses: actions/setup-go@v5
6767
with:
68-
go-version: '1.24.x'
68+
go-version: '1.25.x'
6969
cache: true
7070
check-latest: true
7171

‎benchmark_test.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package cel2sql_test
22

33
import (
4+
"strings"
45
"testing"
56

67
"github.com/google/cel-go/cel"
@@ -322,10 +323,14 @@ func BenchmarkConvertLargeExpression(b *testing.B) {
322323
env := setupSimpleBenchmarkEnv(b)
323324

324325
// Large AND expression
325-
largeAnd := `age > 0`
326+
var builder strings.Builder
327+
builder.WriteString(`age > 0`)
326328
for i := 1; i < 20; i++ {
327-
largeAnd += ` && name != "test` + string(rune('0'+i)) + `"`
329+
builder.WriteString(` && name != "test`)
330+
builder.WriteRune(rune('0' + i))
331+
builder.WriteString(`"`)
328332
}
333+
largeAnd := builder.String()
329334

330335
tests := []struct {
331336
name string

‎go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/spandigital/cel2sql/v3
22

3-
go 1.24.0
3+
go 1.25.5
44

55
require (
66
github.com/google/cel-go v0.26.0
@@ -68,11 +68,11 @@ require (
6868
go.opentelemetry.io/otel/metric v1.35.0 // indirect
6969
go.opentelemetry.io/otel/sdk v1.35.0 // indirect
7070
go.opentelemetry.io/otel/trace v1.35.0 // indirect
71-
golang.org/x/crypto v0.37.0 // indirect
71+
golang.org/x/crypto v0.45.0 // indirect
7272
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
73-
golang.org/x/sync v0.17.0 // indirect
74-
golang.org/x/sys v0.32.0 // indirect
75-
golang.org/x/text v0.29.0 // indirect
73+
golang.org/x/sync v0.18.0 // indirect
74+
golang.org/x/sys v0.38.0 // indirect
75+
golang.org/x/text v0.31.0 // indirect
7676
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
7777
google.golang.org/grpc v1.73.0 // indirect
7878
google.golang.org/protobuf v1.36.6 // indirect

‎go.sum‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,8 @@ go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v8
158158
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
159159
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
160160
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
161-
golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
162-
golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
161+
golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
162+
golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
163163
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
164164
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
165165
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -168,13 +168,13 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
168168
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
169169
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
170170
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
171-
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
172-
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
171+
golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
172+
golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
173173
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
174174
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
175175
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
176-
golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
177-
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
176+
golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
177+
golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
178178
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
179179
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
180180
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -184,14 +184,14 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc
184184
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
185185
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
186186
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
187-
golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
188-
golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
189-
golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
190-
golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
187+
golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
188+
golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
189+
golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
190+
golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
191191
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
192192
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
193-
golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
194-
golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
193+
golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
194+
golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
195195
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
196196
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
197197
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎output_length_test.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -408,10 +408,12 @@ func TestLongStringConcatenations(t *testing.T) {
408408
require.NoError(t, err)
409409

410410
// Build string concatenation expression
411-
expr := "s"
411+
var builder strings.Builder
412+
builder.WriteString("s")
412413
for i := 0; i < tt.stringCount; i++ {
413-
expr += ` + "test"`
414+
builder.WriteString(` + "test"`)
414415
}
416+
expr := builder.String()
415417

416418
ast, issues := env.Compile(expr)
417419
require.NoError(t, issues.Err())

0 commit comments

Comments
 (0)