[FME-9885] Fixed vulnerabilities

.github/workflows/s3.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23.3'
+          go-version: '1.24.6'
 
       - name: Create build folder
         run: mkdir -p build

.github/workflows/test.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23.3'
+          go-version: '1.24.6'
 
       - name: Get version
         run: echo "VERSION=$(awk '/^const Version/{gsub(/"/, "", $4); print $4}' splitio/version.go)" >> $GITHUB_ENV

CHANGES.txt

@@ -1,3 +1,18 @@
+5.10.3 (Sep 5, 2025)
+- Fixed vulnerabilities:
+   - Updated golang image to 1.24.6
+   - Updated debian image to 13.0
+   - Updated gin-contrib/gzip to 1.2.3
+   - Updated gin-gonic/gin 1.10.1
+   - Updated stretchr/testify 1.10.0
+   - Updated golang.org/x/arch 0.20.0
+	- Updated golang.org/x/crypto 0.41.0
+	- Updated golang.org/x/net 0.43.0
+	- Updated golang.org/x/sync 0.16.0
+	- Updated golang.org/x/sys 0.35.0
+	- Updated golang.org/x/text 0.28.0
+	- Updated google.golang.org/protobuf 1.36.8
+
 5.10.2 (May 29, 2025)
 - Fixed vulnerabilities:
    - Updated golang image to 1.23.9

Makefile

@@ -45,6 +45,9 @@ clean:
 	rm -f ./entrypoint.*.sh
 	rm -f ./clilist
 	rm -Rf $(BUILD)/*
+	rm -Rf windows/build/*
+	rm -Rf windows/downloads/*
+	rm -Rf windows/unpacked/*
 
 ## Build split-sync and split-proxy
 build: split-sync split-proxy

docker/Dockerfile.proxy

@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.23.9-bookworm AS builder
+FROM golang:1.24.6-bookworm AS builder
 
 ARG EXTRA_BUILD_ARGS
 ARG FIPS_MODE
@@ -17,19 +17,12 @@ RUN bash -c 'if [[ "${FIPS_MODE}" = "enabled" ]]; \
     fi'
 
 # Runner stage
-FROM debian:12.11 AS runner
+FROM debian:13.0 AS runner
 
 RUN apt update -y
 RUN apt install -y bash ca-certificates
-RUN addgroup --gid 1000 --system 'split-proxy'
-RUN adduser \
-    --disabled-password \
-    --gecos '' \
-    --ingroup 'split-proxy' \
-    --no-create-home \
-    --system \
-    --uid 1000 \
-    'split-proxy'
+RUN groupadd -g 1000 split-proxy
+RUN useradd -r -u 1000 -g split-proxy -s /usr/sbin/nologin split-proxy
 
 COPY docker/functions.sh .
 

docker/Dockerfile.synchronizer

@@ -1,11 +1,12 @@
 # Build stage
-FROM golang:1.23.9-bookworm AS builder
+FROM golang:1.24.6-bookworm AS builder
 
 ARG EXTRA_BUILD_ARGS
 ARG FIPS_MODE
 
-RUN apt update -y
-RUN apt install -y build-essential ca-certificates python3 git
+RUN apt update && \
+    apt install -y --no-install-recommends build-essential ca-certificates python3 git && \
+    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /code
 
@@ -17,19 +18,12 @@ RUN bash -c 'if [[ "${FIPS_MODE}" = "enabled" ]]; \
     fi'
 
 # Runner stage
-FROM debian:12.11 AS runner
+FROM debian:13.0 AS runner
 
 RUN apt update -y
 RUN apt install -y bash ca-certificates
-RUN addgroup --gid 1000 --system 'split-synchronizer'
-RUN adduser \
-    --disabled-password \
-    --gecos '' \
-    --ingroup 'split-synchronizer' \
-    --no-create-home \
-    --system \
-    --uid 1000 \
-    'split-synchronizer'
+RUN groupadd -g 1000 split-synchronizer
+RUN useradd -r -u 1000 -g split-synchronizer -s /usr/sbin/nologin split-synchronizer
 
 COPY docker/functions.sh .
 

go.mod

@@ -1,54 +1,55 @@
 module github.com/splitio/split-synchronizer/v5
 
-go 1.23.9
+go 1.24.6
 
 require (
 	github.com/gin-contrib/cors v1.6.0
-	github.com/gin-contrib/gzip v0.0.6
-	github.com/gin-gonic/gin v1.10.0
+	github.com/gin-contrib/gzip v1.2.3
+	github.com/gin-gonic/gin v1.10.1
 	github.com/google/uuid v1.3.0
 	github.com/splitio/gincache v1.0.1
 	github.com/splitio/go-split-commons/v6 v6.1.0
 	github.com/splitio/go-toolkit/v5 v5.4.0
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	go.etcd.io/bbolt v1.3.6
 	golang.org/x/exp v0.0.0-20231006140011-7918f672742d
 )
 
 require (
 	github.com/bits-and-blooms/bitset v1.3.1 // indirect
 	github.com/bits-and-blooms/bloom/v3 v3.3.1 // indirect
-	github.com/bytedance/sonic v1.11.6 // indirect
-	github.com/bytedance/sonic/loader v0.1.1 // indirect
+	github.com/bytedance/gopkg v0.1.3 // indirect
+	github.com/bytedance/sonic v1.14.1 // indirect
+	github.com/bytedance/sonic/loader v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cloudwego/base64x v0.1.4 // indirect
-	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
-	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
-	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.10 // indirect
+	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.20.0 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/go-playground/validator/v10 v10.27.0 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/redis/go-redis/v9 v9.7.3 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.2.12 // indirect
-	golang.org/x/arch v0.17.0 // indirect
-	golang.org/x/crypto v0.38.0 // indirect
-	golang.org/x/net v0.40.0 // indirect
-	golang.org/x/sync v0.14.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
-	google.golang.org/protobuf v1.34.1 // indirect
+	github.com/ugorji/go/codec v1.3.0 // indirect
+	golang.org/x/arch v0.20.0 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )