Fix CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2026-27171, CVE-2025-60876#233
Merged
kezhenxu94 merged 3 commits intomainfrom Mar 20, 2026
Merged
Fix CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2026-27171, CVE-2025-60876#233kezhenxu94 merged 3 commits intomainfrom
kezhenxu94 merged 3 commits intomainfrom
Conversation
…VE-2025-60876 - Upgrade google.golang.org/grpc from v1.78.0 to v1.79.3 (CVE-2026-33186) - Upgrade Go from 1.25 to 1.25.8 (CVE-2026-25679, CVE-2026-27142) - Upgrade Alpine base image from 3.19 to 3.21 (CVE-2026-27171, CVE-2025-60876)
There was a problem hiding this comment.
Pull request overview
This PR updates the project’s Go and container build dependencies to address several reported CVEs in skywalking-satellite, primarily by bumping google.golang.org/grpc, the Go toolchain version used for builds, and the Alpine runtime base image.
Changes:
- Upgraded
google.golang.org/grpctov1.79.3(and corresponding indirect deps ingo.sum). - Updated the Docker build image to Go
1.25.8and runtime base image toalpine:3.21. - Updated indirect module versions in
go.sumas a result of dependency upgrades.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Bumps Go version declaration and upgrades grpc + indirect genproto reference. |
| go.sum | Refreshes dependency checksums/versions due to module upgrades (grpc, otel, genproto). |
| docker/Dockerfile | Updates builder Go image tag and Alpine runtime base image version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
go.mod
Outdated
| module github.com/apache/skywalking-satellite | ||
|
|
||
| go 1.25 | ||
| go 1.25.8 |
There was a problem hiding this comment.
The go directive in go.mod only accepts a major.minor version (e.g., 1.25), not a patch version. Using go 1.25.8 will cause go mod tidy / builds to fail with an invalid Go version. Keep go 1.25 and, if you need to pin the patch level for the CVE fix, add a toolchain go1.25.8 directive (and/or align CI/Docker to that toolchain).
Suggested change
| go 1.25.8 | |
| go 1.25 | |
| toolchain go1.25.8 |
- Fix go.mod: use 'go 1.25' + 'toolchain go1.25.8' (patch version not valid in go directive) - Fix TestStaticServer: replace fixed sleep with retry loop since grpc.NewClient connects lazily and both connections may not be READY within 1 second - Fix Istio E2E: add xpack.security.enabled=false for ES 8 compatibility
… operator Following apache/skywalking@92a8f5d: - Update SW_KUBERNETES_COMMIT_SHA to 2850db1502283a2d8516146c57cc2b49f1da934b (supports ECK operator with ES 8.18.8) - Add ECK operator installation step before SkyWalking install - Switch helm install from git-clone approach to OCI registry pull - Replace --set elasticsearch.replicas/minimumMasterNodes with --set eckOperator.enabled=false - Fix values file path (no longer relative to chart subdir) - Remove xpack.security.enabled from values.yaml (ECK handles ES security)
wu-sheng
approved these changes
Mar 20, 2026
mrproliu
approved these changes
Mar 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix multiple CVEs in skywalking-satellite:
google.golang.org/grpcfrom v1.78.0 to v1.79.3Changes
go.mod: Bumped Go version to 1.25.8, upgraded grpc to v1.79.3docker/Dockerfile: Updated Go builder image to 1.25.8, Alpine base to 3.21