milvus

mirrors/milvus

0 Fork 0

mirror of https://github.com/milvus-io/milvus.git synced 2026-10-28 17:05:53 +08:00

Files

T

History

Li LiuandClaude Opus 4.6 cb1ad4670f build(deps): [2.6] upgrade Go toolchain and dependencies for CVEs (#52969 )

## Summary

Fix every High/Critical dependency family reported by the latest Trivy
scan of `milvusdb/milvus:2.6-20260827-bfa1bc34` ([Jenkins
#11732](https://jenkins-3.zilliz.cc/job/testplatform_pipeline_v2/job/image_scan/11732/)).

| Findings | Component | From | To |
|---|---|---|---|
| CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283,
CVE-2026-33811, CVE-2026-33814, CVE-2026-33818, CVE-2026-39820,
CVE-2026-39821, CVE-2026-39822, CVE-2026-39836, CVE-2026-42499,
CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859,
CVE-2026-56860, CVE-2026-56862 | Go stdlib | 1.25.8 | 1.25.13 release
toolchain |
| CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831,
CVE-2026-39832, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
CVE-2026-46597 | golang.org/x/crypto | 0.46.0 | 0.55.0 |
| CVE-2026-56864, CVE-2026-56865 | golang.org/x/mod | 0.30.0 | 0.40.0 |
| CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821,
CVE-2026-46600 | golang.org/x/net | 0.48.0 | 0.58.0 |
| CVE-2026-56852 | golang.org/x/text | 0.32.0 | 0.41.0 |
| GHSA-hrxh-6v49-42gf | google.golang.org/grpc | 1.79.3 | 1.82.1 |
| CVE-2026-29181, CVE-2026-39883 | OpenTelemetry | 1.40.0 | 1.43.0 |
| CVE-2026-41602 | Apache Thrift | 0.20.0 | 0.23.0 |

## Compatibility and image coverage

- Keep root, pkg, client, and tests/go_client at the `go 1.25.8` module
compatibility floor. Every upgraded dependency declares support for Go
1.25.0 or older.
- Build all six 2.6 CPU/GPU builder variants with Go 1.25.13; update
macOS CI and the Go SDK test image to match.
- Update the overlapping dependency graph in all four modules so
standalone SDK and pkg consumers do not retain vulnerable versions.
- Supersede closed PR #51412 with a fresh backport on the current 2.6
head. The old unrelated OpenSSL and quinn lockfile changes are
intentionally omitted because Jenkins #11732 reports no High/Critical OS
or Rust findings.

## Verification

- `go mod verify` passed in root, pkg, client, and tests/go_client.
- Root selects Thrift 0.23.0, OpenTelemetry 1.43.0, x/crypto 0.55.0,
x/mod 0.40.0, x/net 0.58.0, x/text 0.41.0, and gRPC 1.82.1.
- With `GOTOOLCHAIN=go1.25.8`, all client packages compiled, pkg
tracer/crypto/logutil compiled, and every tests/go_client package
compiled using `-tags dynamic,test` and `-gcflags="all=-N -l"`.
- The server command dependency graph resolves under Go 1.25.8.
- pkg, client, and tests/go_client tidy cleanly. Root `go mod tidy -e`
reports the pre-existing missing generated migration/legacy/legacypb
package; the resulting dependency graph is tidy.
- Rebuilt CPU/GPU build environments with Go 1.25.13; Jenkins build-env
#45 completed successfully and synchronized `20260828-864b400` to
DockerHub.
- New-image Trivy rescan remains pending runtime image publication.

pr: #49031
pr: #49743
pr: #52685
pr: #52869

---------

Signed-off-by: Li Liu <li.liu@zilliz.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>