Bump go to 1.21.12 / 1.22.5

[ivanvc]

What would you like to be added?

Go 1.21.12 and 1.22.5 include a fix for the GO-2024-2963 vulnerability in net/http. This update should be included in the next 3.5 release.

Completion tracking below:

• main: go v1.22.5 - Bump Go version to 1.22.5: GO-2024-2963 fix. #18270
• release-3.5: go v1.21.12 - [3.5] Bump Go version to 1.21.12: GO-2024-2963 fix #18271
• release-3.4: go v1.21.12 - [3.4]: Bump Go version to 1.21.12: GO-2024-2963 fix. #18272
• CHANGELOG - CHANGELOG: Update to reflect go version 1.21.12 bump #18282
• etcd-io/bbolt main: go v1.22.5 - Bump Go version to 1.22.5: GO-2024-2963 fix bbolt#784
• etcd-io/bbolt release-1.3: v1.21.12 - [1.3] Bump Go version to 1.21.12: GO-2024-2963 fix bbolt#785
• etcd-io/raft main: go v1.22.5 - Bump Go version to 1.22.5: GO-2024-2963 fix raft#205

Refer to previous issues and its pull requests as a reference, i.e., #17964

Why is this needed?

To improve the project security and address the CVE.

[ivanvc]

I'm unsure if we should open this as a good first issue or if we prefer someone with bandwidth to do it soon so we don't hold up #18247.

[thedtripp]

I'd like to help with this. It looks like may take multiple PRs, so let me know where I can assist.

[ivanvc]

/assign @thedtripp

Thank you. You can start with this repository (main, release-3.5, and release-3.4). I'd hold bbolt and raft until we have @ahrtr's input.

[ivanvc]

@thedtripp, we still don't have documentation for this. I was trying to find the issue where I commented on updating the Go version with our latest scripts. However, you now just need to update the .go-version file and then run make fix (which runs ./scripts/sync_go_toolchain_directive.sh).

It is backported to 3.4 and 3.5, so it should be the same process for all the branches.

[thedtripp]

@ivanvc Ok. I'll give that a go on the main branch first. Thanks

[ahrtr]

• etcd-io/bbolt release-1.3: v1.21.12 (do we want to update 1.3?)
• etcd-io/raft main: go v1.22.5 (do we want to update raft?)

I think so.

[ivanvc]

@thedtripp, could you open a PR to update 3.4/3.5 CHANGELOGs? Would you also want to help with bbolt and raft? Or should we open it up for another contributor?
Thank you.

[thedtripp]

@thedtripp, could you open a PR to update 3.4/3.5 CHANGELOGs? Would you also want to help with bbolt and raft? Or should we open it up for another contributor?

Thank you.

Yes, I'd like to help with those. I'll look into it later today.

[ivanvc]

Thanks, @thedtripp. Closing this as there are no outstanding tasks.