Skip to content

chore(upgrade golang): Upgrade golang for CVE fixes.#4505

Open
meet2mky wants to merge 1 commit intov2.5.3_patch_releasefrom
golang-upgrade-for-patch-release-v2_5_3
Open

chore(upgrade golang): Upgrade golang for CVE fixes.#4505
meet2mky wants to merge 1 commit intov2.5.3_patch_releasefrom
golang-upgrade-for-patch-release-v2_5_3

Conversation

@meet2mky
Copy link
Copy Markdown
Collaborator

Description

Upgrade golang for CVE fixes.

Link to the issue in case of a bug fix.

Testing details

  1. Manual - NA
  2. Unit tests - NA
  3. Integration tests - NA

Any backward incompatible change? If so, please explain.

@meet2mky meet2mky requested review from a team and Tulsishah as code owners March 20, 2026 07:08
@meet2mky meet2mky added execute-perf-test Execute performance test in PR execute-integration-tests Run only integration tests labels Mar 20, 2026
@meet2mky meet2mky requested review from kislaykishore and removed request for a team March 20, 2026 07:08
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the Go language version used throughout the project to 1.26.1. This essential upgrade is primarily driven by the need to incorporate critical security fixes for various CVEs, ensuring the application remains robust and secure against known vulnerabilities. The change impacts Dockerfiles, Go module definitions, and several build and test scripts that explicitly download and install Go.

Highlights

  • Go Version Upgrade: The Go programming language version has been upgraded from 1.23.0 to 1.26.1 across the project's build and test environments.
  • Security Fixes: This upgrade specifically addresses known Common Vulnerabilities and Exposures (CVEs) present in older Go versions, enhancing the project's security posture.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly upgrades the Go version to 1.26.1 to address CVEs. My feedback focuses on improving maintainability. In several shell scripts and Dockerfiles, the Go version is hardcoded. I've suggested using variables (GO_VERSION) in shell scripts and ARG in Dockerfiles to centralize the version number. This will make future upgrades much easier. The changes themselves are correct.

Comment thread Dockerfile
Comment thread perfmetrics/scripts/ml_tests/pytorch/run_model.sh
Comment thread perfmetrics/scripts/presubmit_test/pr_perf_test/build.sh
Comment thread tools/cd_scripts/e2e_test.sh
Comment thread tools/containerize_gcsfuse_docker/Dockerfile
Comment thread tools/integration_tests/run_e2e_tests.sh
Comment thread tools/package_gcsfuse_docker/Dockerfile
@meet2mky meet2mky force-pushed the golang-upgrade-for-patch-release-v2_5_3 branch 7 times, most recently from df9c92a to 4d04580 Compare March 20, 2026 10:57
@meet2mky meet2mky force-pushed the golang-upgrade-for-patch-release-v2_5_3 branch from 4d04580 to b338940 Compare March 20, 2026 11:14
@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 20, 2026

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (v2.5.3_patch_release@498e8d2). Learn more about missing BASE report.

Files with missing lines Patch % Lines
internal/logger/logger.go 0.00% 1 Missing ⚠️
Additional details and impacted files
@@                   Coverage Diff                   @@
##             v2.5.3_patch_release    #4505   +/-   ##
=======================================================
  Coverage                        ?   78.89%           
=======================================================
  Files                           ?      106           
  Lines                           ?    11696           
  Branches                        ?        0           
=======================================================
  Hits                            ?     9228           
  Misses                          ?     1991           
  Partials                        ?      477           
Flag Coverage Δ
unittests 78.89% <75.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

execute-integration-tests Run only integration tests execute-perf-test Execute performance test in PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant