From 3661fb61b336f505362fc79dcacba0e9cd88a832 Mon Sep 17 00:00:00 2001 From: Vlad Ligai Date: Wed, 2 Sep 2026 16:50:59 -0400 Subject: [PATCH 1/5] chore(ci): bump Go toolchain to 1.25.13 Raises the pinned Go version from 1.25.12 to 1.25.13 across go.mod, e2e/go.mod and the six workflows that call setup-go. 1.25.12 was the current 1.25 patch when it was pinned on 9 July; 1.25.13 shipped on 11 August. 1.25.13 covers every standard-library advisory the govulncheck gate was carrying an exception for, so STDLIB_ALLOWLIST is removed rather than trimmed. GO-2026-5942 was listed there as needing stdlib@go1.26.6, but its fix range has no 1.25 entry because the 1.25 line was never affected, and govulncheck does not report it on 1.25.12 either. Also bumps golang.org/x/crypto to v0.55.0, which clears GO-2026-6303. GO-2026-6354 and GO-2026-6355 are fixed in x/crypto v0.56.0, which requires go >= 1.26.0 and cannot be taken while the toolchain is pinned to 1.25, so the gate still reports those two. DEP_ALLOWLIST is unchanged. GO-2026-5932 still applies: openpgp has no fixed version and stays out of the build graph. --- .github/workflows/govulncheck.yml | 26 ++++--------------- .../workflows/release_build_infisical_cli.yml | 6 ++--- .github/workflows/run-cli-e2e-tests.yml | 6 ++--- .github/workflows/run-cli-smoke-tests.yml | 2 +- .github/workflows/run-cli-tests.yml | 2 +- .../workflows/test-update-instructions.yml | 8 +++--- e2e/go.mod | 2 +- go.mod | 6 ++--- go.sum | 12 ++++----- 9 files changed, 27 insertions(+), 43 deletions(-) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 51fda665..d11b79de 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -21,7 +21,7 @@ jobs: - name: Setup Go uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.13" cache: true cache-dependency-path: go.sum - name: Install govulncheck @@ -36,32 +36,16 @@ jobs: # We do not import openpgp anywhere; verify with: # go list -deps ./... | grep openpgp # (expect no output) # - # STDLIB_ALLOWLIST holds standard-library advisories whose only remedy is a - # toolchain bump. Every workflow here — including the release build — pins - # 1.25.12, so moving off it is its own change and is deliberately deferred. - # Listing the IDs rather than skipping stdlib wholesale keeps the gate - # honest: a newly published stdlib advisory still fails until someone - # decides to accept or fix it. + # Stdlib advisories are covered by the pinned 1.25.13 toolchain, so there is + # no stdlib allowlist. A newly published stdlib advisory fails the gate; + # fix it by raising the pin rather than by adding an exception here. - name: Run govulncheck (module versions) env: CGO_ENABLED: "0" run: | DEP_ALLOWLIST="GO-2026-5932" - # Fixed in stdlib@go1.25.13, except GO-2026-5942 (stdlib@go1.26.6). - # Delete these once the pinned toolchain covers them. - STDLIB_ALLOWLIST=" - GO-2026-5026 - GO-2026-5942 - GO-2026-5972 - GO-2026-6088 - GO-2026-6089 - GO-2026-6090 - GO-2026-6091 - GO-2026-6218 - " - - ALLOWLIST="$DEP_ALLOWLIST $STDLIB_ALLOWLIST" + ALLOWLIST="$DEP_ALLOWLIST" # Human-readable report (informational; govulncheck exits 3 when it # finds anything, so don't let that fail the step on its own). diff --git a/.github/workflows/release_build_infisical_cli.yml b/.github/workflows/release_build_infisical_cli.yml index 59ee309a..3d73d84a 100644 --- a/.github/workflows/release_build_infisical_cli.yml +++ b/.github/workflows/release_build_infisical_cli.yml @@ -167,7 +167,7 @@ jobs: - run: echo "Ref name ${{github.ref_name}}" - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.12" + go-version: "1.25.13" cache: true cache-dependency-path: go.sum - name: Setup for libssl1.0-dev @@ -394,7 +394,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: - go-version: "1.25.12" + go-version: "1.25.13" cache: true cache-dependency-path: go.sum @@ -474,7 +474,7 @@ jobs: - name: Set up Go uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.12" + go-version: "1.25.13" cache: true cache-dependency-path: go.sum diff --git a/.github/workflows/run-cli-e2e-tests.yml b/.github/workflows/run-cli-e2e-tests.yml index 22a92e34..3081ea33 100644 --- a/.github/workflows/run-cli-e2e-tests.yml +++ b/.github/workflows/run-cli-e2e-tests.yml @@ -16,7 +16,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Install dependencies run: go get . - name: Build the CLI @@ -52,7 +52,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Install dependencies run: go get . - name: Build the CLI @@ -87,7 +87,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Install dependencies run: go get . - name: Cache cargo registry + target diff --git a/.github/workflows/run-cli-smoke-tests.yml b/.github/workflows/run-cli-smoke-tests.yml index abccaeca..6fb52ef8 100644 --- a/.github/workflows/run-cli-smoke-tests.yml +++ b/.github/workflows/run-cli-smoke-tests.yml @@ -25,7 +25,7 @@ jobs: - name: Set up Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Cache cargo registry + target uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 diff --git a/.github/workflows/run-cli-tests.yml b/.github/workflows/run-cli-tests.yml index 3814a3a9..32d04a5c 100644 --- a/.github/workflows/run-cli-tests.yml +++ b/.github/workflows/run-cli-tests.yml @@ -35,7 +35,7 @@ jobs: - name: Setup Go uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Install dependencies run: go get . - name: Test with the Go CLI diff --git a/.github/workflows/test-update-instructions.yml b/.github/workflows/test-update-instructions.yml index b969535d..e090d03a 100644 --- a/.github/workflows/test-update-instructions.yml +++ b/.github/workflows/test-update-instructions.yml @@ -11,7 +11,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Run unit tests run: go test ./packages/util/ -run TestGetUpdateInstructions -v @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Build test helper run: go build -o update-hint.exe ./test/update-hint @@ -70,7 +70,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Build test helper run: go build -o update-hint ./test/update-hint @@ -97,7 +97,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.13" - name: Build test helper run: go build -o update-hint ./test/update-hint diff --git a/e2e/go.mod b/e2e/go.mod index d69523b4..d18eecfa 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -1,6 +1,6 @@ module github.com/infisical/cli/e2e-tests -go 1.25.12 +go 1.25.13 require ( github.com/Infisical/infisical-merge v0.0.0 diff --git a/go.mod b/go.mod index a51f4bb0..4ff5ff67 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/Infisical/infisical-merge -go 1.25.12 +go 1.25.13 require ( github.com/Azure/go-ntlmssp v0.1.1 @@ -52,7 +52,7 @@ require ( github.com/wasilibs/go-re2 v1.10.0 go.mongodb.org/mongo-driver/v2 v2.5.0 go.mozilla.org/pkcs7 v0.9.0 - golang.org/x/crypto v0.54.0 + golang.org/x/crypto v0.55.0 golang.org/x/exp v0.0.0-20250228200357-dead58393ab7 golang.org/x/sync v0.22.0 golang.org/x/sys v0.47.0 @@ -219,7 +219,7 @@ require ( go.uber.org/zap v1.27.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/text v0.40.0 // indirect + golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/api v0.267.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect diff --git a/go.sum b/go.sum index 9fe5eb9e..09f70aff 100644 --- a/go.sum +++ b/go.sum @@ -768,8 +768,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -960,8 +960,8 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -1022,8 +1022,8 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From cd842ccff4440c486985659ff8e0122b1b8e2b1f Mon Sep 17 00:00:00 2001 From: Vlad Ligai Date: Wed, 2 Sep 2026 16:50:59 -0400 Subject: [PATCH 2/5] chore(ci): bump Go toolchain to 1.25.14 Raises the pinned Go version from 1.25.12 to 1.25.14 across go.mod, e2e/go.mod and the six workflows that call setup-go. 1.25.12 was the current 1.25 patch when it was pinned on 9 July. 1.25.14 is the latest on that line, released 18 August, and carries net/http fixes on top of 1.25.13. 1.25.14 covers every standard-library advisory the govulncheck gate was carrying an exception for, so STDLIB_ALLOWLIST is removed rather than trimmed. GO-2026-5942 was listed there as needing stdlib@go1.26.6, but its fix range has no 1.25 entry because the 1.25 line was never affected, and govulncheck does not report it on 1.25.12 either. Also bumps golang.org/x/crypto to v0.55.0, which clears GO-2026-6303. GO-2026-6354 and GO-2026-6355 are fixed in x/crypto v0.56.0, which requires go >= 1.26.0 and cannot be taken while the toolchain is pinned to 1.25, so the gate still reports those two. DEP_ALLOWLIST is unchanged. GO-2026-5932 still applies: openpgp has no fixed version and stays out of the build graph. --- .github/workflows/govulncheck.yml | 26 ++++--------------- .../workflows/release_build_infisical_cli.yml | 6 ++--- .github/workflows/run-cli-e2e-tests.yml | 6 ++--- .github/workflows/run-cli-smoke-tests.yml | 2 +- .github/workflows/run-cli-tests.yml | 2 +- .../workflows/test-update-instructions.yml | 8 +++--- e2e/go.mod | 2 +- go.mod | 6 ++--- go.sum | 12 ++++----- 9 files changed, 27 insertions(+), 43 deletions(-) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 51fda665..ffae2a6e 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -21,7 +21,7 @@ jobs: - name: Setup Go uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.14" cache: true cache-dependency-path: go.sum - name: Install govulncheck @@ -36,32 +36,16 @@ jobs: # We do not import openpgp anywhere; verify with: # go list -deps ./... | grep openpgp # (expect no output) # - # STDLIB_ALLOWLIST holds standard-library advisories whose only remedy is a - # toolchain bump. Every workflow here — including the release build — pins - # 1.25.12, so moving off it is its own change and is deliberately deferred. - # Listing the IDs rather than skipping stdlib wholesale keeps the gate - # honest: a newly published stdlib advisory still fails until someone - # decides to accept or fix it. + # Stdlib advisories are covered by the pinned 1.25.14 toolchain, so there is + # no stdlib allowlist. A newly published stdlib advisory fails the gate; + # fix it by raising the pin rather than by adding an exception here. - name: Run govulncheck (module versions) env: CGO_ENABLED: "0" run: | DEP_ALLOWLIST="GO-2026-5932" - # Fixed in stdlib@go1.25.13, except GO-2026-5942 (stdlib@go1.26.6). - # Delete these once the pinned toolchain covers them. - STDLIB_ALLOWLIST=" - GO-2026-5026 - GO-2026-5942 - GO-2026-5972 - GO-2026-6088 - GO-2026-6089 - GO-2026-6090 - GO-2026-6091 - GO-2026-6218 - " - - ALLOWLIST="$DEP_ALLOWLIST $STDLIB_ALLOWLIST" + ALLOWLIST="$DEP_ALLOWLIST" # Human-readable report (informational; govulncheck exits 3 when it # finds anything, so don't let that fail the step on its own). diff --git a/.github/workflows/release_build_infisical_cli.yml b/.github/workflows/release_build_infisical_cli.yml index 59ee309a..19aa4d33 100644 --- a/.github/workflows/release_build_infisical_cli.yml +++ b/.github/workflows/release_build_infisical_cli.yml @@ -167,7 +167,7 @@ jobs: - run: echo "Ref name ${{github.ref_name}}" - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.12" + go-version: "1.25.14" cache: true cache-dependency-path: go.sum - name: Setup for libssl1.0-dev @@ -394,7 +394,7 @@ jobs: - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: - go-version: "1.25.12" + go-version: "1.25.14" cache: true cache-dependency-path: go.sum @@ -474,7 +474,7 @@ jobs: - name: Set up Go uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.12" + go-version: "1.25.14" cache: true cache-dependency-path: go.sum diff --git a/.github/workflows/run-cli-e2e-tests.yml b/.github/workflows/run-cli-e2e-tests.yml index 22a92e34..547954fd 100644 --- a/.github/workflows/run-cli-e2e-tests.yml +++ b/.github/workflows/run-cli-e2e-tests.yml @@ -16,7 +16,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Install dependencies run: go get . - name: Build the CLI @@ -52,7 +52,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Install dependencies run: go get . - name: Build the CLI @@ -87,7 +87,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Install dependencies run: go get . - name: Cache cargo registry + target diff --git a/.github/workflows/run-cli-smoke-tests.yml b/.github/workflows/run-cli-smoke-tests.yml index abccaeca..1fbe790a 100644 --- a/.github/workflows/run-cli-smoke-tests.yml +++ b/.github/workflows/run-cli-smoke-tests.yml @@ -25,7 +25,7 @@ jobs: - name: Set up Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Cache cargo registry + target uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 diff --git a/.github/workflows/run-cli-tests.yml b/.github/workflows/run-cli-tests.yml index 3814a3a9..1592723a 100644 --- a/.github/workflows/run-cli-tests.yml +++ b/.github/workflows/run-cli-tests.yml @@ -35,7 +35,7 @@ jobs: - name: Setup Go uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Install dependencies run: go get . - name: Test with the Go CLI diff --git a/.github/workflows/test-update-instructions.yml b/.github/workflows/test-update-instructions.yml index b969535d..49c01548 100644 --- a/.github/workflows/test-update-instructions.yml +++ b/.github/workflows/test-update-instructions.yml @@ -11,7 +11,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Run unit tests run: go test ./packages/util/ -run TestGetUpdateInstructions -v @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Build test helper run: go build -o update-hint.exe ./test/update-hint @@ -70,7 +70,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Build test helper run: go build -o update-hint ./test/update-hint @@ -97,7 +97,7 @@ jobs: - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0 with: - go-version: "1.25.12" + go-version: "1.25.14" - name: Build test helper run: go build -o update-hint ./test/update-hint diff --git a/e2e/go.mod b/e2e/go.mod index d69523b4..8c602000 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -1,6 +1,6 @@ module github.com/infisical/cli/e2e-tests -go 1.25.12 +go 1.25.14 require ( github.com/Infisical/infisical-merge v0.0.0 diff --git a/go.mod b/go.mod index a51f4bb0..40b03466 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/Infisical/infisical-merge -go 1.25.12 +go 1.25.14 require ( github.com/Azure/go-ntlmssp v0.1.1 @@ -52,7 +52,7 @@ require ( github.com/wasilibs/go-re2 v1.10.0 go.mongodb.org/mongo-driver/v2 v2.5.0 go.mozilla.org/pkcs7 v0.9.0 - golang.org/x/crypto v0.54.0 + golang.org/x/crypto v0.55.0 golang.org/x/exp v0.0.0-20250228200357-dead58393ab7 golang.org/x/sync v0.22.0 golang.org/x/sys v0.47.0 @@ -219,7 +219,7 @@ require ( go.uber.org/zap v1.27.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/text v0.40.0 // indirect + golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/api v0.267.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect diff --git a/go.sum b/go.sum index 9fe5eb9e..09f70aff 100644 --- a/go.sum +++ b/go.sum @@ -768,8 +768,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -960,8 +960,8 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -1022,8 +1022,8 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From a3201b4f2d70e4658b3e4a023d0ddf5383913005 Mon Sep 17 00:00:00 2001 From: Vlad Ligai Date: Wed, 2 Sep 2026 17:23:33 -0400 Subject: [PATCH 3/5] chore(e2e): tidy e2e module after the root x/crypto bump e2e/go.mod replaces github.com/Infisical/infisical-merge with ../, so raising x/crypto in the root module left the e2e module's requirements stale and go test refused to run: go: updates to go.mod needed; to update it: go mod tidy Brings x/crypto to v0.55.0 and the transitive x/mod, x/text and x/tools along with it, matching the root module. --- e2e/go.mod | 8 ++++---- e2e/go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/e2e/go.mod b/e2e/go.mod index 8c602000..861d9d01 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -22,7 +22,7 @@ require ( github.com/testcontainers/testcontainers-go/modules/compose v0.40.0 github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0 github.com/testcontainers/testcontainers-go/modules/redis v0.40.0 - golang.org/x/crypto v0.54.0 + golang.org/x/crypto v0.55.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -337,15 +337,15 @@ require ( go.uber.org/zap v1.27.0 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect - golang.org/x/mod v0.37.0 // indirect + golang.org/x/mod v0.38.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/term v0.45.0 // indirect - golang.org/x/text v0.40.0 // indirect + golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.14.0 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/tools v0.48.0 // indirect google.golang.org/api v0.267.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect diff --git a/e2e/go.sum b/e2e/go.sum index f87948b2..72a6ca30 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -1176,8 +1176,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -1217,8 +1217,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -1393,8 +1393,8 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -1456,8 +1456,8 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 371915a285f1789d801dd16262b4534f738158b0 Mon Sep 17 00:00:00 2001 From: Vlad Ligai Date: Wed, 2 Sep 2026 17:27:07 -0400 Subject: [PATCH 4/5] chore(ci): allowlist the two x/crypto/ssh advisories blocked by the Go pin GO-2026-6354 and GO-2026-6355 are fixed in golang.org/x/crypto v0.56.0, which declares go 1.26.0 and so cannot be resolved while the toolchain is pinned to 1.25.14. v0.55.0 is the highest release that still supports 1.25. Listed under TOOLCHAIN_BLOCKED rather than DEP_ALLOWLIST. Both have a published fix and x/crypto/ssh is in the build graph, so they meet neither DEP_ALLOWLIST criterion. Keeping them separate records them as owed work rather than as accepted risk, and the existing stale check will flag the entries once the pin moves and they stop being reported. --- .github/workflows/govulncheck.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index ffae2a6e..8d162c2a 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -36,6 +36,17 @@ jobs: # We do not import openpgp anywhere; verify with: # go list -deps ./... | grep openpgp # (expect no output) # + # TOOLCHAIN_BLOCKED is deliberately separate from DEP_ALLOWLIST. These + # advisories DO have a published fix and ARE in our build graph, so they meet + # neither DEP_ALLOWLIST criterion. They are listed only because the fixed + # version needs a newer Go line than we pin. Treat them as owed work, not as + # accepted risk, and delete the entry the moment the pin moves. + # - GO-2026-6354, GO-2026-6355: DoS on deadlocked channels in + # golang.org/x/crypto/ssh, fixed in x/crypto v0.56.0, which declares + # go 1.26.0 and so cannot be resolved on the 1.25 pin. v0.55.0 is the + # highest release that still supports 1.25. x/crypto/ssh is imported in + # seven files, so these are reachable rather than dormant. + # # Stdlib advisories are covered by the pinned 1.25.14 toolchain, so there is # no stdlib allowlist. A newly published stdlib advisory fails the gate; # fix it by raising the pin rather than by adding an exception here. @@ -45,7 +56,12 @@ jobs: run: | DEP_ALLOWLIST="GO-2026-5932" - ALLOWLIST="$DEP_ALLOWLIST" + TOOLCHAIN_BLOCKED=" + GO-2026-6354 + GO-2026-6355 + " + + ALLOWLIST="$DEP_ALLOWLIST $TOOLCHAIN_BLOCKED" # Human-readable report (informational; govulncheck exits 3 when it # finds anything, so don't let that fail the step on its own). From 85789f26b40c011173aea57a2400431cfbb4c46c Mon Sep 17 00:00:00 2001 From: Vlad Ligai Date: Wed, 2 Sep 2026 17:36:09 -0400 Subject: [PATCH 5/5] chore(ci): trim the TOOLCHAIN_BLOCKED comment --- .github/workflows/govulncheck.yml | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 8d162c2a..8d2a9b4a 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -36,20 +36,12 @@ jobs: # We do not import openpgp anywhere; verify with: # go list -deps ./... | grep openpgp # (expect no output) # - # TOOLCHAIN_BLOCKED is deliberately separate from DEP_ALLOWLIST. These - # advisories DO have a published fix and ARE in our build graph, so they meet - # neither DEP_ALLOWLIST criterion. They are listed only because the fixed - # version needs a newer Go line than we pin. Treat them as owed work, not as - # accepted risk, and delete the entry the moment the pin moves. - # - GO-2026-6354, GO-2026-6355: DoS on deadlocked channels in - # golang.org/x/crypto/ssh, fixed in x/crypto v0.56.0, which declares - # go 1.26.0 and so cannot be resolved on the 1.25 pin. v0.55.0 is the - # highest release that still supports 1.25. x/crypto/ssh is imported in - # seven files, so these are reachable rather than dormant. + # TOOLCHAIN_BLOCKED: fix exists but needs a newer Go line than we pin. Not + # accepted risk. Delete once the pin moves. + # - GO-2026-6354, GO-2026-6355: x/crypto/ssh, fixed in v0.56.0 (needs go 1.26). # - # Stdlib advisories are covered by the pinned 1.25.14 toolchain, so there is - # no stdlib allowlist. A newly published stdlib advisory fails the gate; - # fix it by raising the pin rather than by adding an exception here. + # No stdlib allowlist: the pinned toolchain covers them. Raise the pin rather + # than adding an exception. - name: Run govulncheck (module versions) env: CGO_ENABLED: "0"