chore(deps): Bump go directive to 1.25.11#3114
Conversation
|
🎯 Code Coverage (details) 🔗 Commit SHA: edd1c8c | Docs | Datadog PR Page | Give us feedback! |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3114 +/- ##
==========================================
- Coverage 43.49% 42.94% -0.55%
==========================================
Files 352 354 +2
Lines 30025 30545 +520
==========================================
+ Hits 13058 13117 +59
- Misses 16095 16555 +460
- Partials 872 873 +1
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
eb649ca to
459b504
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 459b5041f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
This PR aligns the repository’s Go version declarations by updating the go directives in all modules to the full patch version (1.25.11) and adjusting the Go update automation script so future bumps don’t drift between files.
Changes:
- Update
hack/update-golang.shto write the full$GOVERSION(patch included) into each module’sgodirective. - Bump
godirectives ingo.mod,api/go.mod, andtest/e2e/go.modto1.25.11. - Remove
toolchain go...directives from the modulego.modfiles as part of the version alignment/tidy outcome.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| hack/update-golang.sh | Updates Go version propagation logic for module go directives (now patch-inclusive). |
| go.mod | Bumps module go directive to 1.25.11 and drops toolchain directive. |
| api/go.mod | Bumps module go directive to 1.25.11 and drops toolchain directive. |
| test/e2e/go.mod | Bumps module go directive to 1.25.11 and drops toolchain directive. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Wassim DHIF <[email protected]>
Signed-off-by: Wassim DHIF <[email protected]>
459b504 to
ad4953f
Compare
Co-authored-by: Timothée Bavelier <[email protected]>
Signed-off-by: Wassim DHIF <[email protected]>
Co-authored-by: Timothée Bavelier <[email protected]>
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: queued
mergequeue-status: in_progress
and removed
mergequeue-status: queued
labels
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: done
and removed
mergequeue-status: in_progress
labels
What does this PR do?
Two related changes
hack/update-golang.shsplit logic: writes the full Go patch version ($GOVERSION) togo.modandtest/e2e/go.mod, but keepsapi/go.modat the minor-only form ($new_minor_version). This eliminates spurious patch-level CVE findings on non-api modules without forcing a strictergodirective on the publicapi/submodule.go.modgo 1.25.7→1.25.11andtest/e2e/go.modgo 1.25.8→1.25.11.api/go.modstays atgo 1.25.0.Motivation
The SCA scanner flagged the operator repo for CVE-2025-68121 / GO-2026-4337 (a
crypto/tlssession-resumption bug in stdlib <go1.25.7). Looking at it:toolchaindirective was already pinned togo1.25.11repo-wide, so built binaries are clean (go version -m ./manager→go1.25.11). The runtime was never exposed.godirective literally as "minimum stdlib version" and flag every patch CVE fixed between that value and the running toolchain, even though the actual build is unaffected.update-golang.shconvention of writing minor-only (go 1.X) to all go.mod files made this worse: every script run normalized e.g.go 1.25.0forapi/go.mod, keeping the scanner noise alive across patch versions.The fix is to split the convention along module-purpose lines:
go.modandtest/e2e/go.modare internal to this repo (not imported by external projects), so writing the full patch version is safe and silences SCA noise without breaking anyone.api/go.modis a types-only CRD module imported by other projects (Agent, EDS, dd-source autoscaling, ...). A strictergodirective would force consumers off Go n-1 for no real benefit: the module ships no runtime code, so stdlib CVEs cannot trigger from it. Keeping it minor-only preserves Go's standard n-1/n compatibility guarantee for consumers. The api/-specific scanner finding will be handled via SCA suppression separately.Additional Notes
go1.25.11.make update-golangruns produce the same asymmetric output deterministically, so CI'scheck-golang-versionjob stays green.Minimum Agent Versions
Describe your test plan
make managergobuild— clean buildmake lint—go vet+golangci-lintboth clean (0 issues)make verify-licenses— passmake update-golang && git diff --exit-code— reproduces clean (this is what thecheck-golang-versionCI job runs)api/go.modconfirmed atgo 1.25.0matching main;go.modandtest/e2e/go.modatgo 1.25.11Checklist
dependenciesandtoolingqa/skip-qalabel — recommendqa/skip-qa(no runtime change)