Skip to content

[Snyk] Security upgrade golang from 1.18 to 1.26rc2#18

Open
snyk-io[bot] wants to merge 1 commit intomasterfrom
snyk-fix-480e21daec49f74b899b5810a34308c2
Open

[Snyk] Security upgrade golang from 1.18 to 1.26rc2#18
snyk-io[bot] wants to merge 1 commit intomasterfrom
snyk-fix-480e21daec49f74b899b5810a34308c2

Conversation

@snyk-io
Copy link

@snyk-io snyk-io bot commented Jan 20, 2026

snyk-top-banner

Snyk has created this PR to fix 2 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

  • Dockerfile-secretmessage

We recommend upgrading to golang:1.26rc2, as this image has only 109 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Out-of-bounds Write
SNYK-DEBIAN11-GLIBC-5927133
  823  
high severity Out-of-bounds Write
SNYK-DEBIAN11-GLIBC-5927133
  823  
high severity Out-of-bounds Write
SNYK-DEBIAN11-GLIBC-5927133
  823  
high severity Out-of-bounds Write
SNYK-DEBIAN11-GLIBC-5927133
  823  
critical severity Link Following
SNYK-DEBIAN11-GIT-6846200
  582  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Out-of-bounds Write

@snyk-io
Copy link
Author

snyk-io bot commented Jan 20, 2026

Merge Risk: High

This major version upgrade from Go 1.18 to 1.26rc2 spans multiple significant releases and introduces language changes, tooling updates, and new platform requirements that require careful validation. The use of a release candidate (rc2) adds further risk.

Highlights:

  • Language Change: Go 1.22 changed for loop variable semantics to prevent common bugs. Code relying on the old behavior, where loop variables were shared across iterations, may break. This is a critical change to validate.
  • Platform Support: Support for older operating systems has been dropped. Go 1.21 requires macOS 10.15+ and Go 1.25 requires macOS 12+. Go 1.20 was the last release to support Windows 7/8.

Source: Go documentation
Recommendation: Thoroughly test application behavior, especially loops with goroutines or closures. Verify build and deployment environments meet the new OS requirements before merging.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

0 participants