Skip to content

Commit 06520f8

Browse files
jimmidysonjimmidyson
authored
build: go1.25.1 to fix CVE (#1314)
The majority of changes here are to ensure that the kube-api-linter tool is built with the same version as golangci-lint, which in turn is built with the same go language version of the project, otherwise linting will fail due to language incompatibilities. **What problem does this PR solve?**: **Which issue(s) this PR fixes**: Fixes # **How Has This Been Tested?**: <!-- Please describe the tests that you ran to verify your changes. Provide output from the tests and any manual steps needed to replicate the tests. --> **Special notes for your reviewer**: <!-- Use this to provide any additional information to the reviewers. This may include: - Best way to review the PR. - Where the author wants the most review attention on. - etc. -->
1 parent 2af64a5 commit 06520f8

File tree

8 files changed

+112
-107
lines changed

8 files changed

+112
-107
lines changed

‎api/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ module github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/ap
55

66
go 1.23.0
77

8-
toolchain go1.24.5
8+
toolchain go1.25.1
99

1010
replace github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/common => ../common
1111

‎common/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ module github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/co
55

66
go 1.23.0
77

8-
toolchain go1.24.5
8+
toolchain go1.25.1
99

1010
require (
1111
github.com/evanphx/json-patch/v5 v5.9.11

‎devbox.json‎

Lines changed: 45 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,49 @@
11
{
2-
"packages": [
3-
"actionlint@latest",
4-
"chart-testing@latest",
5-
"clusterctl@latest",
6-
"coreutils@latest",
7-
"crane@latest",
8-
"envsubst@latest",
9-
"findutils@latest",
10-
"gh@latest",
11-
"ginkgo@latest",
12-
"git@latest",
13-
"gnumake@latest",
14-
"gnused@latest",
15-
"go@latest",
16-
"gojq@latest",
17-
"golangci-lint@latest",
18-
"gomplate@latest",
19-
"goreleaser@latest",
20-
"gotestsum@latest",
21-
"govulncheck@latest",
22-
"helm-docs@latest",
23-
"hugo@latest",
24-
"kind@latest",
25-
"ko@latest",
26-
"kubebuilder@latest",
27-
"kubectl@latest",
28-
"kubernetes-controller-tools@latest",
29-
"kustomize@latest",
30-
"pre-commit@latest",
31-
"reviewdog@latest",
32-
"rsync@latest",
33-
"setup-envtest@latest",
34-
"shfmt@latest",
35-
"yamale@latest",
36-
"yamllint@latest",
37-
"yq-go@latest",
38-
"path:./hack/flakes#clusterctl-aws",
39-
"path:./hack/flakes#goprintconst",
40-
"path:./hack/flakes#helm-with-plugins",
41-
"path:./hack/flakes#release-please"
42-
],
2+
"packages": {
3+
"actionlint": "latest",
4+
"chart-testing": "latest",
5+
"clusterctl": "latest",
6+
"coreutils": "latest",
7+
"crane": "latest",
8+
"envsubst": "latest",
9+
"findutils": "latest",
10+
"gh": "latest",
11+
"ginkgo": "latest",
12+
"git": "latest",
13+
"gnumake": "latest",
14+
"gnused": "latest",
15+
"go": "latest",
16+
"gojq": "latest",
17+
"gomplate": "latest",
18+
"goreleaser": "latest",
19+
"gotestsum": "latest",
20+
"govulncheck": "latest",
21+
"helm-docs": "latest",
22+
"hugo": "latest",
23+
"kind": "latest",
24+
"ko": "latest",
25+
"kubebuilder": "latest",
26+
"kubectl": "latest",
27+
"kubernetes-controller-tools": "latest",
28+
"kustomize": "latest",
29+
"pre-commit": "latest",
30+
"reviewdog": "latest",
31+
"rsync": "latest",
32+
"setup-envtest": "latest",
33+
"shfmt": "latest",
34+
"yamale": "latest",
35+
"yamllint": "latest",
36+
"yq-go": "latest",
37+
"path:./hack/flakes#clusterctl-aws": "",
38+
"path:./hack/flakes#golangci-lint": "",
39+
"path:./hack/flakes#goprintconst": "",
40+
"path:./hack/flakes#helm-with-plugins": "",
41+
"path:./hack/flakes#release-please": "",
42+
"apple-sdk_12": {
43+
"version": "latest",
44+
"platforms": ["aarch64-darwin"]
45+
}
46+
},
4347
"shell": {
4448
"scripts": {
4549
"preview-docs": [

‎devbox.lock‎

Lines changed: 39 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,34 @@
4949
}
5050
}
5151
},
52+
"apple-sdk_12@latest": {
53+
"last_modified": "2025-07-28T17:09:23Z",
54+
"resolved": "github:NixOS/nixpkgs/648f70160c03151bc2121d179291337ad6bc564b#apple-sdk_12",
55+
"source": "devbox-search",
56+
"version": "12.3",
57+
"systems": {
58+
"aarch64-darwin": {
59+
"outputs": [
60+
{
61+
"name": "out",
62+
"path": "/nix/store/kvs20yk8vvs0201i1xczafjibvklcacc-apple-sdk-12.3",
63+
"default": true
64+
}
65+
],
66+
"store_path": "/nix/store/kvs20yk8vvs0201i1xczafjibvklcacc-apple-sdk-12.3"
67+
},
68+
"x86_64-darwin": {
69+
"outputs": [
70+
{
71+
"name": "out",
72+
"path": "/nix/store/0lwhprmdl5qfhca48jhg3r9zsyv2a7p2-apple-sdk-12.3",
73+
"default": true
74+
}
75+
],
76+
"store_path": "/nix/store/0lwhprmdl5qfhca48jhg3r9zsyv2a7p2-apple-sdk-12.3"
77+
}
78+
}
79+
},
5280
"chart-testing@latest": {
5381
"last_modified": "2025-07-13T22:45:35Z",
5482
"resolved": "github:NixOS/nixpkgs/a421ac6595024edcfbb1ef950a3712b89161c359#chart-testing",
@@ -853,54 +881,6 @@
853881
}
854882
}
855883
},
856-
"golangci-lint@latest": {
857-
"last_modified": "2025-07-18T03:30:42Z",
858-
"resolved": "github:NixOS/nixpkgs/e821e03193486359aa942372be2d9c1f377b7a18#golangci-lint",
859-
"source": "devbox-search",
860-
"version": "2.2.2",
861-
"systems": {
862-
"aarch64-darwin": {
863-
"outputs": [
864-
{
865-
"name": "out",
866-
"path": "/nix/store/00sy2bp921ax5cxphxz0ifgax6i97mx7-golangci-lint-2.2.2",
867-
"default": true
868-
}
869-
],
870-
"store_path": "/nix/store/00sy2bp921ax5cxphxz0ifgax6i97mx7-golangci-lint-2.2.2"
871-
},
872-
"aarch64-linux": {
873-
"outputs": [
874-
{
875-
"name": "out",
876-
"path": "/nix/store/gvay3vc5ll70dfryiy6qa16w3ybagiq7-golangci-lint-2.2.2",
877-
"default": true
878-
}
879-
],
880-
"store_path": "/nix/store/gvay3vc5ll70dfryiy6qa16w3ybagiq7-golangci-lint-2.2.2"
881-
},
882-
"x86_64-darwin": {
883-
"outputs": [
884-
{
885-
"name": "out",
886-
"path": "/nix/store/9pxfg0y3hiaf08vnzk2fs4qh76r2kd22-golangci-lint-2.2.2",
887-
"default": true
888-
}
889-
],
890-
"store_path": "/nix/store/9pxfg0y3hiaf08vnzk2fs4qh76r2kd22-golangci-lint-2.2.2"
891-
},
892-
"x86_64-linux": {
893-
"outputs": [
894-
{
895-
"name": "out",
896-
"path": "/nix/store/z0d7708yc7d0z6nj0mwalbi6hf79yj68-golangci-lint-2.2.2",
897-
"default": true
898-
}
899-
],
900-
"store_path": "/nix/store/z0d7708yc7d0z6nj0mwalbi6hf79yj68-golangci-lint-2.2.2"
901-
}
902-
}
903-
},
904884
"gomplate@latest": {
905885
"last_modified": "2025-07-13T22:45:35Z",
906886
"resolved": "github:NixOS/nixpkgs/a421ac6595024edcfbb1ef950a3712b89161c359#gomplate",
@@ -1142,50 +1122,50 @@
11421122
}
11431123
},
11441124
"hugo@latest": {
1145-
"last_modified": "2025-05-16T20:19:48Z",
1146-
"resolved": "github:NixOS/nixpkgs/12a55407652e04dcf2309436eb06fef0d3713ef3#hugo",
1125+
"last_modified": "2025-07-28T17:09:23Z",
1126+
"resolved": "github:NixOS/nixpkgs/648f70160c03151bc2121d179291337ad6bc564b#hugo",
11471127
"source": "devbox-search",
1148-
"version": "0.147.3",
1128+
"version": "0.148.2",
11491129
"systems": {
11501130
"aarch64-darwin": {
11511131
"outputs": [
11521132
{
11531133
"name": "out",
1154-
"path": "/nix/store/2wcphqjdn02ym0ps4jj9rimakxffjkhh-hugo-0.147.3",
1134+
"path": "/nix/store/9yj3fphpkjkkhhr8pfxk5r6ws41n17qy-hugo-0.148.2",
11551135
"default": true
11561136
}
11571137
],
1158-
"store_path": "/nix/store/2wcphqjdn02ym0ps4jj9rimakxffjkhh-hugo-0.147.3"
1138+
"store_path": "/nix/store/9yj3fphpkjkkhhr8pfxk5r6ws41n17qy-hugo-0.148.2"
11591139
},
11601140
"aarch64-linux": {
11611141
"outputs": [
11621142
{
11631143
"name": "out",
1164-
"path": "/nix/store/msavmv3qsw5dxbffdinl8r6gabljc3lq-hugo-0.147.3",
1144+
"path": "/nix/store/zg314jwfh6q428ymnl57nv7jqyyaq1qz-hugo-0.148.2",
11651145
"default": true
11661146
}
11671147
],
1168-
"store_path": "/nix/store/msavmv3qsw5dxbffdinl8r6gabljc3lq-hugo-0.147.3"
1148+
"store_path": "/nix/store/zg314jwfh6q428ymnl57nv7jqyyaq1qz-hugo-0.148.2"
11691149
},
11701150
"x86_64-darwin": {
11711151
"outputs": [
11721152
{
11731153
"name": "out",
1174-
"path": "/nix/store/ahhy6049rlifzxr2y5azy2mnvpqpbk32-hugo-0.147.3",
1154+
"path": "/nix/store/wyhy996fyn61b1cgbl5b7xpha74kxzcq-hugo-0.148.2",
11751155
"default": true
11761156
}
11771157
],
1178-
"store_path": "/nix/store/ahhy6049rlifzxr2y5azy2mnvpqpbk32-hugo-0.147.3"
1158+
"store_path": "/nix/store/wyhy996fyn61b1cgbl5b7xpha74kxzcq-hugo-0.148.2"
11791159
},
11801160
"x86_64-linux": {
11811161
"outputs": [
11821162
{
11831163
"name": "out",
1184-
"path": "/nix/store/i9xazh3hcy7q364vns26c19jwqv6xgik-hugo-0.147.3",
1164+
"path": "/nix/store/ji15a88bnlzhpkinvbmbb9vnkhmmx3m2-hugo-0.148.2",
11851165
"default": true
11861166
}
11871167
],
1188-
"store_path": "/nix/store/i9xazh3hcy7q364vns26c19jwqv6xgik-hugo-0.147.3"
1168+
"store_path": "/nix/store/ji15a88bnlzhpkinvbmbb9vnkhmmx3m2-hugo-0.148.2"
11891169
}
11901170
}
11911171
},

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ module github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix
55

66
go 1.24.0
77

8-
toolchain go1.24.5
8+
toolchain go1.25.1
99

1010
replace (
1111
github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/api => ./api

‎hack/flakes/flake.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎hack/flakes/flake.nix‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@
1010
flake-utils.lib.eachDefaultSystem (system:
1111
with nixpkgs.legacyPackages.${system}; rec {
1212
packages = rec {
13+
# Versions available via Devbox are currently behind due to nixhubi.io not being updated
14+
# correctly. Referencing the package in this flake directly from nixpkgs is the workaround.
15+
# This is required to support Go 1.25.
16+
# Once https://github.com/jetify-com/devbox/issues/2609 is fixed, this can be removed.
17+
golangci-lint = pkgs.golangci-lint;
18+
1319
goprintconst = buildGo124Module rec {
1420
name = "goprintconst";
1521
version = "0.0.1-dev";

‎make/go.mk‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ endif
4545

4646
.PHONY: test.%
4747
test.%: ## Runs go tests for a specific module
48+
# TODO: Remove once https://github.com/golang/go/issues/75031 is fixed.
49+
test.%: export GOTOOLCHAIN := $(shell go version | cut -d ' ' -f3)+auto
4850
test.%: go-generate ; $(info $(M) running tests$(if $(GOTEST_RUN), matching "$(GOTEST_RUN)") for $* module)
4951
$(if $(filter-out root,$*),cd $* && )$(call go_test)
5052

@@ -156,9 +158,19 @@ lint.%: ## Runs golangci-lint run for a specific module
156158
lint.%: hack/tools/golangci-lint-kube-api-linter fmt.% ; $(info $(M) linting $* module)
157159
$(if $(filter-out root,$*),cd $* && )$(PWD)/hack/tools/golangci-lint-kube-api-linter run --fix --config=$(GOLANGCI_CONFIG_FILE)
158160

161+
# Ensure that the golangci-lint-kube-api-linter tool is using the same version of Go as the golangci-lint tool, which
162+
# should in turn be the same language version as the project.
163+
GOLANGCI_LINT_VERSION := $(shell golangci-lint version --json 2>/dev/null | gojq --raw-output '.goVersion')
164+
GOLANGCI_LINT_KUBE_API_LINTER_VERSION := $(shell hack/tools/golangci-lint-kube-api-linter version --json 2>/dev/null | gojq --raw-output '.goVersion')
165+
ifneq ($(GOLANGCI_LINT_VERSION),$(GOLANGCI_LINT_KUBE_API_LINTER_VERSION))
166+
.PHONY: hack/tools/golangci-lint-kube-api-linter
167+
endif
168+
# Explicitly set the GOTOOLCHAIN environment variable to the same version of Go as the golangci-lint tool
169+
# to ensure that the go version is the same as the golangci-lint tool.
170+
hack/tools/golangci-lint-kube-api-linter: export GOTOOLCHAIN := $(GOLANGCI_LINT_VERSION)
159171
hack/tools/golangci-lint-kube-api-linter: hack/tools/.custom-gcl.yml
160172
hack/tools/golangci-lint-kube-api-linter: ; $(info $(M) installing golangci-lint-kube-api-linter tool)
161-
cd hack/tools && golangci-lint custom
173+
cd hack/tools && golangci-lint custom --verbose
162174

163175
.PHONY: mod-tidy
164176
mod-tidy: ## Run go mod tidy for all modules
@@ -259,6 +271,9 @@ endif
259271
ifneq ($(words $(GO_SUBMODULES_NO_DOCS)),0)
260272
go-mod-edit-toolchain: $(addprefix go-mod-edit-toolchain.,$(GO_SUBMODULES_NO_DOCS:/go.mod=))
261273
endif
274+
ifneq ($(wildcard $(REPO_ROOT)/hack/tools/go.mod),)
275+
cd hack/tools && go mod edit -toolchain=$(GO_TOOLCHAIN_VERSION)
276+
endif
262277

263278
.PHONY: go-mod-edit-toolchain.%
264279
go-mod-edit-toolchain.%: ## Edits the go.mod file of a specifc module in repository to use the toolchain version

0 commit comments

Comments
 (0)