Skip to content

Commit 024b1cc

Browse files
thaJeztahthaJeztah
committed
update to go1.20.11, test go1.21.4
go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package. See the Go 1.20.11 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.20.11+label%3ACherryPickApproved - full diff: golang/go@go1.20.10...go1.20.11 from the security mailing: [security] Go 1.21.4 and Go 1.20.11 are released Hello gophers, We have just released Go versions 1.21.4 and 1.20.11, minor point releases. These minor releases include 2 security fixes following the security policy: - path/filepath: recognize `\??\` as a Root Local Device path prefix. On Windows, a path beginning with `\??\` is a Root Local Device path equivalent to a path beginning with `\\?\`. Paths with a `\??\` prefix may be used to access arbitrary locations on the system. For example, the path `\??\c:\x` is equivalent to the more common path c:\x. The filepath package did not recognize paths with a `\??\` prefix as special. Clean could convert a rooted path such as `\a\..\??\b` into the root local device path `\??\b`. It will now convert this path into `.\??\b`. `IsAbs` did not report paths beginning with `\??\` as absolute. It now does so. VolumeName now reports the `\??\` prefix as a volume name. `Join(`\`, `??`, `b`)` could convert a seemingly innocent sequence of path elements into the root local device path `\??\b`. It will now convert this to `\.\??\b`. This is CVE-2023-45283 and https://go.dev/issue/63713. - path/filepath: recognize device names with trailing spaces and superscripts The `IsLocal` function did not correctly detect reserved names in some cases: - reserved names followed by spaces, such as "COM1 ". - "COM" or "LPT" followed by a superscript 1, 2, or 3. `IsLocal` now correctly reports these names as non-local. This is CVE-2023-45284 and https://go.dev/issue/63713. Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent 2e40459 commit 024b1cc

9 files changed

Lines changed: 10 additions & 10 deletions

File tree

‎.github/workflows/build-test-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
steps:
4242
- uses: actions/setup-go@v3
4343
with:
44-
go-version: "1.20.10"
44+
go-version: "1.20.11"
4545

4646
- uses: actions/checkout@v3
4747
with:

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ on:
1212
env:
1313
# Go version we currently use to build containerd across all CI.
1414
# Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
15-
GO_VERSION: "1.20.10"
15+
GO_VERSION: "1.20.11"
1616

1717
permissions: # added using https://github.com/step-security/secure-workflows
1818
contents: read
@@ -233,7 +233,7 @@ jobs:
233233
strategy:
234234
matrix:
235235
os: [ubuntu-20.04, macos-12, windows-2019, windows-2022]
236-
go-version: ["1.20.10", "1.21.3"]
236+
go-version: ["1.20.11", "1.21.4"]
237237
steps:
238238
- name: Install dependencies
239239
if: matrix.os == 'ubuntu-20.04'

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333

3434
- uses: actions/setup-go@v3
3535
with:
36-
go-version: 1.20.10
36+
go-version: 1.20.11
3737

3838
# Initializes the CodeQL tools for scanning.
3939
- name: Initialize CodeQL

‎.github/workflows/images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
steps:
2727
- uses: actions/setup-go@v3
2828
with:
29-
go-version: "1.20.10"
29+
go-version: "1.20.11"
3030

3131
- uses: actions/checkout@v3
3232
with:

‎.github/workflows/nightly.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
- '.github/workflows/nightly.yml'
88

99
env:
10-
GO_VERSION: "1.20.10"
10+
GO_VERSION: "1.20.11"
1111

1212
permissions: # added using https://github.com/step-security/secure-workflows
1313
contents: read

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
name: Containerd Release
77

88
env:
9-
GO_VERSION: "1.20.10"
9+
GO_VERSION: "1.20.11"
1010

1111
permissions: # added using https://github.com/step-security/secure-workflows
1212
contents: read

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ EOF
9595
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
9696
sh.upload_path = "/tmp/vagrant-install-golang"
9797
sh.env = {
98-
'GO_VERSION': ENV['GO_VERSION'] || "1.20.10",
98+
'GO_VERSION': ENV['GO_VERSION'] || "1.20.11",
9999
}
100100
sh.inline = <<~SHELL
101101
#!/usr/bin/env bash

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#
1111
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
1212

13-
ARG GOLANG_VERSION=1.20.10
13+
ARG GOLANG_VERSION=1.20.11
1414
ARG GOLANG_IMAGE=golang
1515

1616
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

‎script/setup/prepare_env_windows.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# lived test environment.
66
Set-MpPreference -DisableRealtimeMonitoring:$true
77

8-
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.10"; make = ""; nssm = "" }
8+
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.11"; make = ""; nssm = "" }
99

1010
Write-Host "Downloading chocolatey package"
1111
curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

0 commit comments

Comments
 (0)