1. docker
  2. Commit 74b71c41ac22bac0b2e345e1b360521bd2bcbb48
Browse code

update to go1.23.8 (fix CVE-2025-22871)

full diff: https://github.com/golang/go/compare/go1.23.7...go1.23.8
release notes: https://go.dev/doc/devel/release#go1.24.2

go1.23.8 (released 2025-04-01) includes security fixes to the net/http package,
as well as bug fixes to the runtime and the go command. See the Go 1.23.8
milestone on our issue tracker for details;

https://github.com/golang/go/issues?q=milestone%3AGo1.23.8+label%3ACherryPickApproved

From the mailing list:

Hello gophers,

We have just released Go versions 1.24.2 and 1.23.8, minor point releases.
These minor releases include 1 security fixes following the security policy:

- net/http: request smuggling through invalid chunked data
The net/http package accepted data in the chunked transfer encoding
containing an invalid chunk-size line terminated by a bare LF.
When used in conjunction with a server or proxy which incorrectly
interprets a bare LF in a chunk extension as part of the extension,
this could permit request smuggling.
The net/http package now rejects chunk-size lines containing a bare LF.
Thanks to Jeppe Bonde Weikop for reporting this issue.
This is CVE-2025-22871 and Go issue https://go.dev/issue/71988.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Sebastiaan van Stijn authored on 2025/04/03 19:30:00
Showing 12 changed files
.github/workflows/.test.yml
History View file @ 74b71c4
... ... 
@@ -21,7 +21,7 @@ on:
21 21 
         default: "graphdriver"
22 22
23 23 
 env:
24 
-  GO_VERSION: "1.23.7"
24 
+  GO_VERSION: "1.23.8"
25 25 
   GOTESTLIST_VERSION: v0.3.1
26 26 
   TESTSTAT_VERSION: v0.1.25
27 27 
   ITG_CLI_MATRIX_SIZE: 6
.github/workflows/.windows.yml
History View file @ 74b71c4
... ... 
@@ -28,7 +28,7 @@ on:
28 28 
         default: false
29 29
30 30 
 env:
31 
-  GO_VERSION: "1.23.7"
31 
+  GO_VERSION: "1.23.8"
32 32 
   GOTESTLIST_VERSION: v0.3.1
33 33 
   TESTSTAT_VERSION: v0.1.25
34 34 
   WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore
.github/workflows/arm64.yml
History View file @ 74b71c4
... ... 
@@ -23,7 +23,7 @@ on:
23 23 
   pull_request:
24 24
25 25 
 env:
26 
-  GO_VERSION: "1.23.7"
26 
+  GO_VERSION: "1.23.8"
27 27 
   TESTSTAT_VERSION: v0.1.25
28 28 
   DESTDIR: ./build
29 29 
   SETUP_BUILDX_VERSION: edge
.github/workflows/buildkit.yml
History View file @ 74b71c4
... ... 
@@ -23,7 +23,7 @@ on:
23 23 
   pull_request:
24 24
25 25 
 env:
26 
-  GO_VERSION: "1.23.7"
26 
+  GO_VERSION: "1.23.8"
27 27 
   DESTDIR: ./build
28 28 
   SETUP_BUILDX_VERSION: edge
29 29 
   SETUP_BUILDKIT_IMAGE: moby/buildkit:latest
.github/workflows/codeql.yml
History View file @ 74b71c4
... ... 
@@ -58,7 +58,7 @@ jobs:
58 58 
       - name: Update Go
59 59 
         uses: actions/setup-go@v5
60 60 
         with:
61 
-          go-version: "1.23.7"
61 
+          go-version: "1.23.8"
62 62 
       - name: Initialize CodeQL
63 63 
         uses: github/codeql-action/init@v3
64 64 
         with:
.github/workflows/test.yml
History View file @ 74b71c4
... ... 
@@ -23,7 +23,7 @@ on:
23 23 
   pull_request:
24 24
25 25 
 env:
26 
-  GO_VERSION: "1.23.7"
26 
+  GO_VERSION: "1.23.8"
27 27 
   GIT_PAGER: "cat"
28 28 
   PAGER: "cat"
29 29 
   SETUP_BUILDX_VERSION: edge
.golangci.yml
History View file @ 74b71c4
... ... 
@@ -40,7 +40,7 @@ linters:
40 40 
 run:
41 41 
   # prevent golangci-lint from deducting the go version to lint for through go.mod,
42 42 
   # which causes it to fallback to go1.17 semantics.
43 
-  go: "1.23.7"
43 
+  go: "1.23.8"
44 44 
   concurrency: 2
45 45 
   # Only supported with go modules enabled (build flag -mod=vendor only valid when using modules)
46 46 
   # modules-download-mode: vendor
Dockerfile
History View file @ 74b71c4
... ... 
@@ -1,6 +1,6 @@
1 1 
 # syntax=docker/dockerfile:1.7
2 2
3 
-ARG GO_VERSION=1.23.7
3 
+ARG GO_VERSION=1.23.8
4 4 
 ARG BASE_DEBIAN_DISTRO="bookworm"
5 5 
 ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
6 6 
 ARG XX_VERSION=1.6.1
Dockerfile.simple
History View file @ 74b71c4
... ... 
@@ -5,7 +5,7 @@
5 5
6 6 
 # This represents the bare minimum required to build and test Docker.
7 7
8 
-ARG GO_VERSION=1.23.7
8 
+ARG GO_VERSION=1.23.8
9 9
10 10 
 ARG BASE_DEBIAN_DISTRO="bookworm"
11 11 
 ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
Dockerfile.windows
History View file @ 74b71c4
... ... 
@@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG}
161 161 
 # Use PowerShell as the default shell
162 162 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
163 163
164 
-ARG GO_VERSION=1.23.7
164 
+ARG GO_VERSION=1.23.8
165 165 
 ARG GOTESTSUM_VERSION=v1.12.0
166 166 
 ARG GOWINRES_VERSION=v0.3.1
167 167 
 ARG CONTAINERD_VERSION=v1.7.27
hack/dockerfiles/generate-files.Dockerfile
History View file @ 74b71c4
... ... 
@@ -1,6 +1,6 @@
1 1 
 # syntax=docker/dockerfile:1
2 2
3 
-ARG GO_VERSION=1.23.7
3 
+ARG GO_VERSION=1.23.8
4 4 
 ARG BASE_DEBIAN_DISTRO="bookworm"
5 5 
 ARG PROTOC_VERSION=3.11.4
6 6
hack/dockerfiles/govulncheck.Dockerfile
History View file @ 74b71c4
... ... 
@@ -1,6 +1,6 @@
1 1 
 # syntax=docker/dockerfile:1
2 2
3 
-ARG GO_VERSION=1.23.7
3 
+ARG GO_VERSION=1.23.8
4 4 
 ARG GOVULNCHECK_VERSION=v1.1.3
5 5 
 ARG FORMAT=text
6 6