Skip to content

Repository navigation

Fix critical Go runtime, HTTP/2, and CI tooling vulnerabilities #21636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kylos101 merged 8 commits into from
Oct 20, 2026
+1,626 −1,687
Merged

Fix critical Go runtime, HTTP/2, and CI tooling vulnerabilities #21636

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
00d6378
Fix critical Go CVEs from daily scan
kylos101 Oct 11, 2026
d9d87f4
Fix workspacekit sync message formatting for Go vet
kylos101 Oct 16, 2026
2f218f1
Fix docker-up embedded x/net vulnerability
kylos101 Oct 20, 2026
23eddc8
Remove obsolete CI toolchain bootstrap after image promotion
kylos101 Oct 20, 2026
ebe2fdb
Fix critical vulnerabilities in standalone CI tooling dependencies
kylos101 Oct 20, 2026
34fe892
Keep BuildKit binaries from the published Gitpod fork image
kylos101 Oct 20, 2026
a35ad02
fix(image-builder): use refreshed Gitpod BuildKit image
kylos101 Oct 20, 2026
c80f444
Use the published GHCR BuildKit image for Bob
kylos101 Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion WORKSPACE.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ defaultArgs:
clionDownloadUrl: "https://download.jetbrains.com/cpp/CLion-2025.1.1.tar.gz"
rustroverDownloadUrl: "https://download.jetbrains.com/rustrover/RustRover-2025.1.2.tar.gz"
jbBackendVersion: "latest"
dockerVersion: "29.5.3"
dockerVersion: "29.9.0"
dockerComposeVersion: "2.40.3"
ipfsKuboVersion: "v0.18.0"
ipfsClusterVersion: "v1.0.8"
Expand Down
16 changes: 8 additions & 8 deletions components/blobserve/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/gitpod-io/gitpod/blobserve

go 1.25.0
go 1.26.0

godebug tlsmlkem=0

Expand All @@ -16,7 +16,7 @@ require (
github.com/opencontainers/image-spec v1.1.0
github.com/prometheus/client_golang v1.19.1
github.com/spf13/cobra v1.8.1
golang.org/x/sync v0.20.0
golang.org/x/sync v0.23.0
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028
)

Expand Down Expand Up @@ -141,14 +141,14 @@ require (
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
golang.org/x/crypto v0.52.0 // indirect
golang.org/x/crypto v0.57.0 // indirect
golang.org/x/exp v0.0.0-20240213143201-ec583247a57a // indirect
golang.org/x/mod v0.35.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/mod v0.41.0 // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/sys v0.48.0 // indirect
golang.org/x/text v0.42.0 // indirect
golang.org/x/time v0.12.0 // indirect
golang.org/x/tools v0.44.0 // indirect
golang.org/x/tools v0.49.0 // indirect
gonum.org/v1/gonum v0.16.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/grpc v1.79.3 // indirect
Expand Down
32 changes: 16 additions & 16 deletions components/blobserve/go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 5 additions & 5 deletions components/common-go/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/gitpod-io/gitpod/common-go

go 1.25.0
go 1.26.0

godebug tlsmlkem=0

Expand All @@ -21,8 +21,8 @@ require (
github.com/slok/go-http-metrics v0.10.0
github.com/stretchr/testify v1.9.0
github.com/uber/jaeger-client-go v2.29.1+incompatible
golang.org/x/sync v0.20.0
golang.org/x/sys v0.45.0
golang.org/x/sync v0.23.0
golang.org/x/sys v0.48.0
golang.org/x/time v0.3.0
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
google.golang.org/grpc v1.79.3
Expand Down Expand Up @@ -65,8 +65,8 @@ require (
github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c // indirect
go.uber.org/atomic v1.10.0 // indirect
go.uber.org/goleak v1.3.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/text v0.42.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
gopkg.in/DATA-DOG/go-sqlmock.v1 v1.3.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
16 changes: 8 additions & 8 deletions components/common-go/go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 5 additions & 5 deletions components/content-service-api/go/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/gitpod-io/gitpod/content-service/api

go 1.25.0
go 1.26.0

godebug tlsmlkem=0

Expand Down Expand Up @@ -41,10 +41,10 @@ require (
github.com/uber/jaeger-client-go v2.29.1+incompatible // indirect
github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
go.uber.org/atomic v1.10.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/sync v0.20.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/sync v0.23.0 // indirect
golang.org/x/sys v0.48.0 // indirect
golang.org/x/text v0.42.0 // indirect
golang.org/x/time v0.3.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand Down
16 changes: 8 additions & 8 deletions components/content-service-api/go/go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 4 additions & 4 deletions components/content-service-api/typescript/util/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/gitpod-io/gitpod/content-service-api/util

go 1.25.0
go 1.26.0

godebug tlsmlkem=0

Expand All @@ -15,9 +15,9 @@ require (
github.com/iancoleman/strcase v0.0.0-20180726023541-3605ed457bf7 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.0.2 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/sys v0.48.0 // indirect
golang.org/x/text v0.42.0 // indirect
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6 // indirect
google.golang.org/grpc v1.79.3 // indirect
Expand Down
12 changes: 6 additions & 6 deletions components/content-service-api/typescript/util/go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading