Prepare 1.37.0

[teresaromero]

• Update changelog
• Update Go runtime to 1.25.8 to resolve stdlib vulnerabilities in html/template, os, net/url.

Requires #1612

[prodsecmachine]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[mrodm]

I would use for now Golang 1.25.8.
We also have the go.mod that sets go 1.25.0
https://github.com/elastic/package-spec/blob/3e48996fb4c8a34ef105b0487fe689b8ab69000f/go.mod#L3

[teresaromero]

vulnerabilities are fixed at 1.26.1, shall we update all to 1.26 then or not fix them?

[teresaromero]

my mistake, i was running with 1.26. changing to 1.25.8

[mrodm]

This version is not available in chocolatey, because there are already 1.26.x versions published.

https://community.chocolatey.org/packages/golang#versionhistory

We could add some workaround like this one
https://github.com/elastic/package-registry/pull/1425/changes#diff-c5e35c6e40d940300d332e3c9a1e3fa03c3f19d767b00e05166b9a7c19097b2dR13-R19

to install a specific version for the unit tests running in Windows.

WDYT @jsoriano @teresaromero ?

Other option, but I didn't test it, is to update the .buildkite/hooks/pre-command to allow use an environment variable in a given buildkite step.

That would mean to update this script:

package-registry/.buildkite/hooks/pre-command

Lines 7 to 10 in 9701314

	echo "Golang version:"
	version=$(cat .go-version)
	export SETUP_GOLANG_VERSION="${version}"
	echo "${SETUP_GOLANG_VERSION}"

To be something like this:

echo "Golang version:"
version=$(cat .go-version)
export SETUP_GOLANG_VERSION="${SETUP_GOLANG_VERSION:-$version}"
echo "${SETUP_GOLANG_VERSION}"

And then add the environment variable here:

package-registry/.buildkite/pipeline.yml

Lines 54 to 62 in 9701314

	- label: ":windows: Test on Windows"
	key: test-win
	command:
	- ".buildkite/scripts/run-tests.ps1"
	agents:
	provider: "gcp"
	image: "${WINDOWS_AGENT_IMAGE}"
	artifact_paths:
	- "tests-report-win.xml"

      - label: ":windows: Test on Windows"
        key: test-win
        command:
          - ".buildkite/scripts/run-tests.ps1"
        env:
          SETUP_GOLANG_VERSION: 1.25.7 
        agents:
          provider: "gcp"
          image: "${WINDOWS_AGENT_IMAGE}"
        artifact_paths:
          - "tests-report-win.xml"

The problem with this last approach is that it should be removed that environment variable once a 1.26.x version is set in .go-version

[teresaromero]

We could add some workaround like this one
https://github.com/elastic/package-registry/pull/1425/changes#diff-c5e35c6e40d940300d332e3c9a1e3fa03c3f19d767b00e05166b9a7c19097b2dR13-R19

i prefer re-using this approach

[mrodm]

Tried to use a different approached based on gvm (same tool that it is used in linux steps) to avoid these "ifs"

#1617

[mrodm]

LGTM
We could continue now with 1.25.8 and then in the next one update up to 1.26.x versions.

[mrodm]

🚀

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: bc88a8b

History

• 💚 Build #1804 succeeded a4d46d8
• 💔 Build #1803 failed 96b7848
• 💔 Build #1796 failed 73d3531
• 💚 Build #1794 succeeded fb615c0