Skip to content

fix(cve): bump go toolchain and x/net, x/sys to close trivy findings #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sarat-k merged 1 commit into from
Jul 10, 2026
Merged

fix(cve): bump go toolchain and x/net, x/sys to close trivy findings #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion sw/nic/gpuagent/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,12 +176,16 @@ $(TARGET)_gim: build-libs gogo-protos gen-protos $(OBJ_GIM)
.PHONY: mod
mod:
@go mod tidy
@go mod edit -go=1.25.11
@go mod edit -go=1.25.12
#CVE-2024-24790 - gpuctl
@go mod edit -replace golang.org/x/net@v0.30.0=golang.org/x/net@v0.38.0
#CVE-2026-33186
@go mod edit -replace google.golang.org/grpc@v1.72.1=google.golang.org/grpc@v1.79.3
@go mod edit -replace google.golang.org/grpc@v1.69.0-dev=google.golang.org/grpc@v1.79.3
#CVE-2026-25681,CVE-2026-27136,CVE-2026-33814,CVE-2026-39821,CVE-2026-25680,CVE-2026-42502,CVE-2026-42506
@go mod edit -replace golang.org/x/net@v0.48.0=golang.org/x/net@v0.55.0
#CVE-2026-39824
@go mod edit -replace golang.org/x/sys@v0.39.0=golang.org/x/sys@v0.44.0
@go mod vendor


Expand Down
13 changes: 9 additions & 4 deletions sw/nic/gpuagent/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/ROCm/gpu-agent/sw/nic/gpuagent

go 1.25.11
go 1.25.12

require (
github.com/gogo/protobuf v1.3.2
Expand All @@ -15,14 +15,19 @@ require (
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/spf13/pflag v1.0.6 // indirect
golang.org/x/net v0.48.0 // indirect
golang.org/x/sys v0.39.0 // indirect
golang.org/x/text v0.32.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/text v0.37.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
)

replace golang.org/x/net v0.30.0 => golang.org/x/net v0.38.0
replace (
golang.org/x/net v0.30.0 => golang.org/x/net v0.38.0
golang.org/x/net v0.48.0 => golang.org/x/net v0.55.0
)

replace (
google.golang.org/grpc v1.69.0-dev => google.golang.org/grpc v1.79.3
google.golang.org/grpc v1.72.1 => google.golang.org/grpc v1.79.3
)

replace golang.org/x/sys v0.39.0 => golang.org/x/sys v0.44.0
12 changes: 6 additions & 6 deletions sw/nic/gpuagent/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,20 +47,20 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
Expand Down
6 changes: 3 additions & 3 deletions tools/build-container/Dokerfile.rhel9
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,13 @@

RUN yum install -y sudo

RUN wget https://go.dev/dl/go1.25.11.linux-amd64.tar.gz && \
tar -C /usr/local -xzf go1.25.11.linux-amd64.tar.gz && \
rm -f go1.25.11.linux-amd64.tar.gz
RUN wget https://go.dev/dl/go1.25.12.linux-amd64.tar.gz && \
tar -C /usr/local -xzf go1.25.12.linux-amd64.tar.gz && \
rm -f go1.25.12.linux-amd64.tar.gz

ENV PATH=$PATH:/usr/local/go/bin:/root/go/bin
ENV LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH

Check warning on line 36 in tools/build-container/Dokerfile.rhel9

View workflow job for this annotation

GitHub Actions / Build

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$LD_LIBRARY_PATH'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH

Check warning on line 37 in tools/build-container/Dokerfile.rhel9

View workflow job for this annotation

GitHub Actions / Build

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$PKG_CONFIG_PATH'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

ADD ./entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
Expand Down
6 changes: 3 additions & 3 deletions tools/build-container/Dokerfile.ubu2204
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,9 @@ RUN apt-get update && apt-get install -y \

WORKDIR /usr/src/github.com/Rocm/gpu-agent/

RUN wget https://go.dev/dl/go1.25.11.linux-amd64.tar.gz && \
tar -C /usr/local -xzf go1.25.11.linux-amd64.tar.gz && \
rm -f go1.25.11.linux-amd64.tar.gz
RUN wget https://go.dev/dl/go1.25.12.linux-amd64.tar.gz && \
tar -C /usr/local -xzf go1.25.12.linux-amd64.tar.gz && \
rm -f go1.25.12.linux-amd64.tar.gz

ADD ./entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
Expand Down
Loading