Skip to content

Fix CVEs in dependencies #401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
szkiba merged 3 commits into from
Dec 17, 2025
Merged

Fix CVEs in dependencies #401

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
011d03c
fix: update gosec version to 2.22.11 in Dockerfiles
szkiba Dec 17, 2025
dfc21f9
fix: Setting go 1.25.5 to guarantee the go version used.
szkiba Dec 17, 2025
d2d544d
feat: add release notes for v1.3.2
szkiba Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
id-token: write
with:
# #region inputs
go-version: "1.25.x"
go-version: "1.25.5"
goreleaser-version: "2.13.0"
k6-versions: '["v1.2.3","v1.0.0"]'
bats: ./.github/release.bats
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG GO_VERSION=1.25.5-alpine3.22@sha256:3587db7cc96576822c606d119729370dbf581931c5f43ac6d3fa03ab4ed85a10
ARG GOSEC_VERSION=2.22.10@sha256:c8852d609f9af551387555a81808a3bca8d172629b124fab0d83c937cabc2f3d
ARG GOSEC_VERSION=2.22.11@sha256:4c42d880c93d9a38771dc130a705bae2480a45a1bb32240249806b12d7641d6d

FROM securego/gosec:${GOSEC_VERSION} AS gosec

Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.goreleaser
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG GO_VERSION=1.25.5-alpine3.22@sha256:3587db7cc96576822c606d119729370dbf581931c5f43ac6d3fa03ab4ed85a10
ARG GOSEC_VERSION=2.22.10@sha256:c8852d609f9af551387555a81808a3bca8d172629b124fab0d83c937cabc2f3d
ARG GOSEC_VERSION=2.22.11@sha256:4c42d880c93d9a38771dc130a705bae2480a45a1bb32240249806b12d7641d6d

FROM securego/gosec:${GOSEC_VERSION} AS gosec

Expand Down
9 changes: 9 additions & 0 deletions releases/v1.3.2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
Grafana **xk6** `v1.3.2` is here! 🎉

This is a patch release that addresses security vulnerabilities in dependencies.

## Security

- [#400](https://github.com/grafana/xk6/issues/400)
- Update Docker base image to gosec 2.22.11
- Set go version to v1.25.5 in release workflow
Loading