You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "1fanwang (via GitHub)" <gi...@apache.org> on 2026/08/14 00:06:53 UTC
[PR] Keep the Go SDK CI toolchain on the latest patch release [airflow]
1fanwang opened a new pull request, #71582:
URL: https://github.com/apache/airflow/pull/71582
The Go SDK job fails on `govulncheck`, which reports seven reachable standard
library advisories:
```
Vulnerability #1: GO-2026-6218
Avoid quadratic complexity in resolvePath in net/url
Standard library
Found in: net/url@go1.25.12
Fixed in: net/url@go1.25.13
```
All seven are already fixed in go1.25.13, which has been stable on go.dev since
today. CI never gets it: `go-version: 1.25` resolves through the
`actions/go-versions` manifest, and that manifest tops out at 1.25.12. It was
last updated on 2026-07-08 and has no pending update, so the job stays red for
weeks after every Go security release.
`check-latest: true` makes setup-go resolve the pin against go.dev instead of the
cached manifest, still picking the newest `1.25` patch. The pinned minor is
unchanged, so `check-go-version-in-sync` and the go.mod relationship both hold.
Only the two workflows that run the scan are touched.
# Testing Done
| # | Scenario | Result |
|---|---|---|
| 1 | `govulncheck ./...` on go1.25.12, the version CI resolves today | 7 reachable stdlib advisories |
| 2 | `govulncheck ./...` on go1.25.13, the version `check-latest` selects | No vulnerabilities found |
| 3 | `check-go-version-in-sync` prek hook | Consistent across all 8 pin sites |
| 4 | Workflow hooks: yamllint, zizmor, amd/arm sync | Passed |
<details><summary>Raw logs</summary>
Red, from the failing job on go1.25.12:
```console
$ govulncheck ./...
=== Symbol Results ===
Vulnerability #1: GO-2026-6218 Found in: net/url@go1.25.12 Fixed in: net/url@go1.25.13
Vulnerability #2: GO-2026-6091 Found in: html/template@go1.25.12 Fixed in: html/template@go1.25.13
Vulnerability #3: GO-2026-6090 Found in: crypto/tls@go1.25.12 Fixed in: crypto/tls@go1.25.13
Vulnerability #4: GO-2026-6089 Found in: net/http@go1.25.12 Fixed in: net/http@go1.25.13
```
Green, same module and same govulncheck v1.6.0, on go1.25.13:
```console
$ go version
go version go1.25.13 darwin/arm64
$ govulncheck ./...
=== Symbol Results ===
No vulnerabilities found.
Your code is affected by 0 vulnerabilities.
```
Version pinning stays consistent:
```console
$ uv run --project scripts python scripts/ci/prek/check_go_version_in_sync.py
OK: Go version is consistently 1.25 across all 8 pin sites.
$ prek run --files .github/workflows/ci-amd.yml .github/workflows/ci-arm.yml --stage pre-commit
Check ci-arm.yml and ci-amd.yml stay in sync.............................Passed
Check Go toolchain version is consistent across build files..............Passed
Check YAML files with yamllint...........................................Passed
Run zizmor to check for github workflow syntax errors....................Passed
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin the Go SDK CI toolchain to the patched Go release [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #71582:
URL: https://github.com/apache/airflow/pull/71582#issuecomment-5288405133
### Backport failed to create: v3-3-test. View the failure log <a href='https://github.com/apache/airflow/actions/runs/31761086687'> Run details </a>
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>❌</td>
<td>v3-3-test</td>
<td><a href="https://github.com/apache/airflow/commit/2aef6b1c80c8c57b83972731090d1e578e613459"><img src='https://img.shields.io/badge/Commit-2aef6b1-red' alt='Commit Link'></a></td>
</tr>
</table>
You can attempt to backport this manually by running:
```bash
cherry_picker 2aef6b1 v3-3-test
```
This should apply the commit to the v3-3-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.
After you have resolved the conflicts, you can continue the backport process by running:
```bash
cherry_picker --continue
```
If you don't have cherry-picker installed, see the [installation guide](https://github.com/apache/airflow/blob/main/dev/README.md#how-to-backport-pr-with-cherry-picker-cli).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Pin the Go SDK CI toolchain to the patched Go release [airflow]
Posted by "jason810496 (via GitHub)" <gi...@apache.org>.
jason810496 merged PR #71582:
URL: https://github.com/apache/airflow/pull/71582
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org