Skip to content

Prepare 1.37.0#1613

Merged
teresaromero merged 9 commits intoelastic:mainfrom
teresaromero:prepare-1.37.0
Mar 11, 2026
Merged

Prepare 1.37.0#1613
teresaromero merged 9 commits intoelastic:mainfrom
teresaromero:prepare-1.37.0

Conversation

@teresaromero
Copy link
Copy Markdown
Contributor

@teresaromero teresaromero commented Mar 10, 2026

  • Update changelog
  • Update Go runtime to 1.25.8 to resolve stdlib vulnerabilities in html/template, os, net/url.

Requires #1612

@teresaromero teresaromero requested a review from a team as a code owner March 10, 2026 12:22
@prodsecmachine
Copy link
Copy Markdown

prodsecmachine commented Mar 10, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

.go-version Outdated
@@ -1 +1 @@
1.25.7
1.26.1
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would use for now Golang 1.25.8.
We also have the go.mod that sets go 1.25.0
https://github.com/elastic/package-spec/blob/3e48996fb4c8a34ef105b0487fe689b8ab69000f/go.mod#L3

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

vulnerabilities are fixed at 1.26.1, shall we update all to 1.26 then or not fix them?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my mistake, i was running with 1.26. changing to 1.25.8

@@ -1 +1 @@
1.25.7
1.25.8
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This version is not available in chocolatey, because there are already 1.26.x versions published.

https://community.chocolatey.org/packages/golang#versionhistory

We could add some workaround like this one
https://github.com/elastic/package-registry/pull/1425/changes#diff-c5e35c6e40d940300d332e3c9a1e3fa03c3f19d767b00e05166b9a7c19097b2dR13-R19

to install a specific version for the unit tests running in Windows.

WDYT @jsoriano @teresaromero ?

Other option, but I didn't test it, is to update the .buildkite/hooks/pre-command to allow use an environment variable in a given buildkite step.

That would mean to update this script:

echo "Golang version:"
version=$(cat .go-version)
export SETUP_GOLANG_VERSION="${version}"
echo "${SETUP_GOLANG_VERSION}"

To be something like this:

echo "Golang version:"
version=$(cat .go-version)
export SETUP_GOLANG_VERSION="${SETUP_GOLANG_VERSION:-$version}"
echo "${SETUP_GOLANG_VERSION}"

And then add the environment variable here:

- label: ":windows: Test on Windows"
key: test-win
command:
- ".buildkite/scripts/run-tests.ps1"
agents:
provider: "gcp"
image: "${WINDOWS_AGENT_IMAGE}"
artifact_paths:
- "tests-report-win.xml"

      - label: ":windows: Test on Windows"
        key: test-win
        command:
          - ".buildkite/scripts/run-tests.ps1"
        env:
          SETUP_GOLANG_VERSION: 1.25.7 
        agents:
          provider: "gcp"
          image: "${WINDOWS_AGENT_IMAGE}"
        artifact_paths:
          - "tests-report-win.xml"

The problem with this last approach is that it should be removed that environment variable once a 1.26.x version is set in .go-version

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tried to use a different approached based on gvm (same tool that it is used in linux steps) to avoid these "ifs"

#1617

Copy link
Copy Markdown
Contributor

@mrodm mrodm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
We could continue now with 1.25.8 and then in the next one update up to 1.26.x versions.

Co-authored-by: Mario Rodriguez Molins <marrodmo@gmail.com>
Copy link
Copy Markdown
Contributor

@mrodm mrodm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

@elasticmachine
Copy link
Copy Markdown

💚 Build Succeeded

History

@teresaromero teresaromero merged commit 2ef1943 into elastic:main Mar 11, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants