Security: bump Go toolchain to 1.26.7 and patch CVE-flagged dependencies - #2
Open
zdcthomas wants to merge 1 commit into
Open
Security: bump Go toolchain to 1.26.7 and patch CVE-flagged dependencies#2zdcthomas wants to merge 1 commit into
zdcthomas wants to merge 1 commit into
Conversation
Datadog SCA (2026-08-21) flags this repo for CVEs in the Go 1.20 stdlib and several stale modules. This bumps the toolchain everywhere it is pinned (go.mod, Dockerfile, CI workflows, devcontainer) and upgrades the flagged modules: - Go toolchain 1.20.5 -> 1.26.7 (CVE-2023-24538, CVE-2023-24540, CVE-2024-24790, CVE-2025-68121) - golang.org/x/crypto v0.17.0 -> v0.55.0 (CVE-2024-45337, CVE-2026-46595) - google.golang.org/grpc v1.56.3 -> v1.83.1 (CVE-2026-33186) - golang.org/x/net v0.17.0 -> v0.58.0 (CVE-2026-39821) - google.golang.org/protobuf v1.30.0 -> v1.36.12 - github.com/buger/jsonparser v1.1.1 -> v1.6.1 - golang.org/x/text v0.14.0 -> v0.41.0 - github.com/golang/glog v1.1.0 -> v1.2.5 - golang.org/x/sys v0.15.0 -> v0.47.0 Also fixes three pre-existing 'non-constant format string' call sites (exchange/auction.go, adapters/adapterstest, amp_auction_test.go) that the Go 1.24+ vet printf check now rejects during 'go test'. go build ./... and go test ./... pass with the new toolchain.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The 2026-08-21 Datadog SCA export flags this repo (and its
prebid-server-prodtwin) for CVEs in the Go 1.20 standard library and several stale dependencies. This PR bumps the Go toolchain everywhere it is pinned and upgrades the flagged modules to current patched releases.CVEs addressed
Toolchain pin changes
go.mod:go 1.20→go 1.26.7Dockerfile:go1.20.5.linux-amd64.tar.gz→go1.26.7.linux-amd64.tar.gz.github/workflows/validate.yml: matrix[1.19.x, 1.20.x]→[1.26.x].github/workflows/validate-merge.yml,.github/workflows/adapter-code-coverage.yml:1.20.5→1.26.7.devcontainer/devcontainer.json:VARIANT1.20→1.261.26.7 (rather than the week-old 1.27.0) was chosen as the current patched release of a mature line.
Code changes required by the bump
Go 1.24+
go vet(run automatically bygo test) rejects non-constant format strings; three pre-existing call sites had to be fixed to keep the test suite compiling:exchange/auction.go,adapters/adapterstest/adapter_test_util.go,endpoints/openrtb2/amp_auction_test.go. No behavior change.No gRPC/protobuf API migration was needed — the 1.56→1.83 / 1.30→1.36 jumps compile clean.
Verification
go build ./...— cleango test ./...— full suite passes. (analytics/pubstack TestNewConfigUpdateHttpTaskflaked once on a 5ms-ticker/200ms-window race, passed 3/3 in isolation and on a full fresh rerun; unrelated to these bumps.)Not fixed / out of scope
adzerk/prebid-server-prodappears to be a mirror of this repo (same push timestamp in the SCA export); it needs the same change or a re-mirror after this merges — not touched here.go get -u ./...blanket upgrade: only SCA-flagged modules (plus whatgo mod tidypulls transitively) were bumped, to keep the diff reviewable.Note: deploying prebid-server is prod-impacting (prod a0x calls the prebid ALB in the staging account) — deploy needs its own gating and approval.
🤖 Generated with Claude Code
Jira: RL-313