From cf6781dd6fbefc265776c584284196ddd4a15247 Mon Sep 17 00:00:00 2001 From: trtllm-agent <296075020+trtllm-agent@users.noreply.github.com> Date: Thu, 16 Jul 2026 23:53:54 -0700 Subject: [PATCH 1/2] [nvbugs/6467684][fix] bump golang image/license_checker to pull x/net >= 0.55.0 The Jenkins release-check pod pinned golang:1.22 (Go 1.22 bundles the vulnerable golang.org/x/net@v0.51.0, CVE-2026-39821) and installed license_checker@v0.3.0 built against that toolchain. Bump both pins: - golang image tag 1.22 -> 1.23 (Go 1.23 ships x/net >= 0.55.0) - license_checker@v0.3.0 -> v0.3.1 (rebuilt against the newer toolchain so the transitive x/net pin lands >= 0.55.0) Signed-off-by: trtllm-agent <296075020+trtllm-agent@users.noreply.github.com> --- jenkins/L0_MergeRequest.groovy | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/jenkins/L0_MergeRequest.groovy b/jenkins/L0_MergeRequest.groovy index f9fbc38b33a0..e3192292b101 100644 --- a/jenkins/L0_MergeRequest.groovy +++ b/jenkins/L0_MergeRequest.groovy @@ -541,13 +541,13 @@ def launchReleaseCheck(pipeline, globalVars) variable: 'DEFAULT_GIT_URL' ) ]) { - sh "go install ${DEFAULT_GIT_URL}/TensorRT/Infrastructure/licensechecker/cmd/license_checker@v0.3.0" + sh "go install ${DEFAULT_GIT_URL}/TensorRT/Infrastructure/licensechecker/cmd/license_checker@v0.3.1" } } sh "cd ${LLM_ROOT}/cpp && /go/bin/license_checker -config ../jenkins/license_cpp.json include tensorrt_llm" } - def image = "urm.nvidia.com/docker/golang:1.22" + def image = "urm.nvidia.com/docker/golang:1.23" stageName = "Release-Check" trtllm_utils.launchKubernetesPod(pipeline, createKubernetesPodConfig(image, "package"), "trt-llm", { stage("[${stageName}] Run") { From 8fccb7a8f53b1b60baf3b06d6a996d5385e996a5 Mon Sep 17 00:00:00 2001 From: Emma Qiao Date: Thu, 20 Aug 2026 10:30:01 +0800 Subject: [PATCH 2/2] Update back license_checker version to v0.3.0 Signed-off-by: Emma Qiao --- jenkins/L0_MergeRequest.groovy | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jenkins/L0_MergeRequest.groovy b/jenkins/L0_MergeRequest.groovy index e3192292b101..22921111a56a 100644 --- a/jenkins/L0_MergeRequest.groovy +++ b/jenkins/L0_MergeRequest.groovy @@ -541,7 +541,7 @@ def launchReleaseCheck(pipeline, globalVars) variable: 'DEFAULT_GIT_URL' ) ]) { - sh "go install ${DEFAULT_GIT_URL}/TensorRT/Infrastructure/licensechecker/cmd/license_checker@v0.3.1" + sh "go install ${DEFAULT_GIT_URL}/TensorRT/Infrastructure/licensechecker/cmd/license_checker@v0.3.0" } } sh "cd ${LLM_ROOT}/cpp && /go/bin/license_checker -config ../jenkins/license_cpp.json include tensorrt_llm"