You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "tetrate-ci (via GitHub)" <gi...@apache.org> on 2026/06/04 00:15:58 UTC
[PR] cves: bump go toolchain to 1.26.4 [skywalking-satellite]
tetrate-ci opened a new pull request, #258:
URL: https://github.com/apache/skywalking-satellite/pull/258
## CVEs addressed
Bump the Go toolchain from 1.26.3 to 1.26.4 to fix the following Go stdlib CVEs:
| Severity | CVE | Component | Fix |
|----------|-----|-----------|-----|
| UNKNOWN | CVE-2026-42504 | stdlib | bumped Go toolchain 1.26.3 → 1.26.4 |
| UNKNOWN | CVE-2026-27145 | stdlib | bumped Go toolchain 1.26.3 → 1.26.4 |
| UNKNOWN | CVE-2026-42507 | stdlib | bumped Go toolchain 1.26.3 → 1.26.4 |
cc @kezhenxu94
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump go toolchain to 1.26.4 [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #258:
URL: https://github.com/apache/skywalking-satellite/pull/258#issuecomment-4626588849
Hi @kezhenxu94, the PR has been sitting with your approval for a while. The only failure is the known flaky `Istio(1.21.0)+ALS(mx-mesh)` test (infrastructure issue, not related to our Go 1.26.4 bump). All other CI checks are green. Would you be able to merge this PR despite the Istio 1.21.0 flakiness? This is blocking security CVE fixes in downstream repositories. Thank you\!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump go toolchain to 1.26.4 [skywalking-satellite]
Posted by "kezhenxu94 (via GitHub)" <gi...@apache.org>.
kezhenxu94 merged PR #258:
URL: https://github.com/apache/skywalking-satellite/pull/258
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump go toolchain to 1.26.4 [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #258:
URL: https://github.com/apache/skywalking-satellite/pull/258#issuecomment-4628410542
All CI checks are now passing and the PR is approved. Could you please merge this? This fixes CVE-2026-42504 (High), CVE-2026-27145, and CVE-2026-42507 in Go 1.26.4.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump go toolchain to 1.26.4 [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #258:
URL: https://github.com/apache/skywalking-satellite/pull/258#issuecomment-4625243172
Hi @kezhenxu94, thanks for the approval! The `Istio(1.21.0)+ALS(mx-mesh)` check seems to be a flaky infrastructure failure — all other CI checks (including all other Istio versions) are passing. Could you please rerun the failed check or merge this PR since the failure appears to be unrelated to our Go 1.26.4 toolchain bump? This fixes CVE-2026-42504, CVE-2026-27145, and CVE-2026-42507.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump go toolchain to 1.26.4 [skywalking-satellite]
Posted by "tetrate-ci (via GitHub)" <gi...@apache.org>.
tetrate-ci commented on PR #258:
URL: https://github.com/apache/skywalking-satellite/pull/258#issuecomment-4627032462
Hi @kezhenxu94 — thank you again for the approval! The only failing check is `Istio(1.21.0)+ALS(mx-mesh)` which appears to be a flaky infrastructure test (it caused all subsequent ALS tests to be cancelled via fail-fast). All other CI checks pass including `result`, `CI (ubuntu/windows)`, all Native E2E tests, `build`, and all MetricsService checks.
Could you please either:
1. Merge directly (all relevant checks pass), or
2. Re-trigger the failing `Istio(1.21.0)+ALS(mx-mesh)` check to see if it passes on retry?
This fix is blocking CVE remediation in the downstream monorepo. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org