mirror of
https://github.com/milvus-io/milvus.git
synced 2026-10-28 08:55:40 +08:00
Li Liu
9d441ec7cb
## Summary
Fix the High-severity Go stdlib CVE reported by the daily image scan
(`milvusdb/milvus:master-20261021-d0ce73ca`).
| CVE | Component | Installed | Fixed | Severity |
|-----|-----------|-----------|-------|----------|
| CVE-2026-111943 | Go stdlib `crypto/x509` | v1.26.9 | 1.26.10 / 1.27.3
| High |
CVE-2026-111943: man-in-the-middle attacks via untrusted intermediate
certificates in `crypto/x509`, fixed in Go 1.26.10.
## Change scope
Bump the Go toolchain `1.26.9` -> `1.26.10`:
- `go.mod` / `pkg/go.mod` / `tests/go_client/go.mod`: `go 1.26.9` ->
`1.26.10`
- Builder images (build the `bin/milvus` copied into every runtime
image):
-
`build/docker/builder/cpu/{ubuntu22.04,ubuntu20.04,ubuntu24.04,amazonlinux2023,rockylinux9}/Dockerfile`
- `build/docker/builder/gpu/{ubuntu22.04,ubuntu20.04}/Dockerfile`
- `build/docker/meta-migration/builder/Dockerfile`
- `build/rpm/setup-env.sh`
- `tests/go_client/Dockerfile`
- `.github/workflows/mac.yaml`,
`.github/workflows/publish-krte-images.yaml`
## Runtime image coverage
This is a Go toolchain fix. The six published runtime Dockerfiles
(`build/docker/milvus/{ubuntu22.04,ubuntu20.04,amazonlinux2023,rockylinux9}`
and `gpu/{ubuntu22.04,ubuntu20.04}`) copy the same `bin/milvus` / `lib/`
outputs built by the above builder images, so bumping the shared builder
toolchain + `go.mod` covers every image. No per-Dockerfile OS-package
change is required and none is skipped.
`client/go.mod` is left unchanged (client library intentionally supports
older Go).
Auto-generated CVE fix (autonomous run).
Signed-off-by: Li Liu <li.liu@zilliz.com>
Signed-off-by: Li Liu <li.liu@zilliz.com>