From 6a69da612a8b7040c966ffdafa873a3a9e347f5e Mon Sep 17 00:00:00 2001 From: Alkin Tezuysal Date: Wed, 21 Oct 2026 20:36:57 +0000 Subject: [PATCH] build: bump Go to 1.27.3 for CVE-2026-111943 The operator image is built with golang:1.27.2, whose crypto/x509 is affected by CVE-2026-111943 (HIGH, fixed in 1.27.3). The Trivy step in CI fails on every PR because of it. Move the go directive and the builder image to 1.27.3. No dependency changes; go mod tidy -diff is clean. Co-Authored-By: Claude Opus 5.5 (1M context) --- operator/Dockerfile | 2 +- operator/go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/operator/Dockerfile b/operator/Dockerfile index f55d5ef..0fe176e 100644 --- a/operator/Dockerfile +++ b/operator/Dockerfile @@ -14,7 +14,7 @@ # docker buildx build --push --platform=linux/amd64,linux/arm64 \ # -t ghcr.io/proxysql/proxysql-operator: . -FROM --platform=${BUILDPLATFORM} golang:1.27.2 AS builder +FROM --platform=${BUILDPLATFORM} golang:1.27.3 AS builder ARG TARGETOS=linux ARG TARGETARCH ARG VERSION=dev diff --git a/operator/go.mod b/operator/go.mod index 70c452d..a11a2af 100644 --- a/operator/go.mod +++ b/operator/go.mod @@ -1,6 +1,6 @@ module github.com/ProxySQL/kubernetes/operator -go 1.27.2 +go 1.27.3 require ( github.com/go-sql-driver/mysql v1.10.0