Skip to content

fix: rebuild binaries using Go 1.25.5 to address CVE-2025-61729 #2682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ucatbas merged 1 commit into from
Dec 8, 2025
Merged

fix: rebuild binaries using Go 1.25.5 to address CVE-2025-61729 #2682

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
with:
go-version: '1.25.1'
go-version: '1.25.5'

- name: tests
run: make test
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/nightly.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
with:
go-version: ~1.25.1
go-version: ~1.25.5
- name: Log in to GHCR
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
with:
go-version: ~1.25.1
go-version: ~1.25.5
- name: Log in to GHCR
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS permify-builder
FROM golang:1.25.5-alpine@sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 AS permify-builder
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

golang:1.25.5-alpine sha256 digest Docker Hub

💡 Result:

I found two image digests shown on Docker Hub for golang:1.25.5-alpine:

  • sha256:6d6d1e4e530e8512543843504590c86b30524dd8644953c3435fa5b3396ae39c. [1]
  • sha256:c07ca287f049960e8b699d433376d879b7ee3e576b1e0239c476d9b28c6343c4. [2]

Note: multi‑arch images often show a manifest-list digest and per‑platform image digests; use docker pull golang:1.25.5-alpine (the CLI prints the digest you pulled) or docker manifest inspect / Registry API to confirm the exact digest for your platform. [2]

Update the Docker image digest for golang:1.25.5-alpine.

The digest sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 pinned on lines 1 and 7 does not match the official golang:1.25.5-alpine image on Docker Hub. The correct digests are:

  • sha256:6d6d1e4e530e8512543843504590c86b30524dd8644953c3435fa5b3396ae39c
  • sha256:c07ca287f049960e8b699d433376d879b7ee3e576b1e0239c476d9b28c6343c4

(Exact digest depends on platform architecture.) Update both stages to use the correct digest to ensure reproducibility and security.

🤖 Prompt for AI Agents 
In Dockerfile around lines 1 and 7, the pinned digest for golang:1.25.5-alpine
is incorrect; replace the bad
sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 with one
of the official digests for golang:1.25.5-alpine (for your target platform) —
either sha256:6d6d1e4e530e8512543843504590c86b30524dd8644953c3435fa5b3396ae39c
or sha256:c07ca287f049960e8b699d433376d879b7ee3e576b1e0239c476d9b28c6343c4 — and
update both FROM lines (both stages) to use the chosen correct digest to ensure
reproducible, secure builds.

WORKDIR /go/src/app
RUN apk update && apk add --no-cache git
COPY . .
RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -v ./cmd/permify/

FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS health-probe-builder
FROM golang:1.25.5-alpine@sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 AS health-probe-builder
WORKDIR /go/src/app
RUN apk update && apk add --no-cache git
RUN git clone https://github.com/grpc-ecosystem/grpc-health-probe.git
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.local
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Use the correct Go version
FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb
FROM golang:1.25.5-alpine@sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9

RUN apk --no-cache add curl git

Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.release
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build stage for gRPC health probe
FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS health-probe-builder
FROM golang:1.25.5-alpine@sha256:26111811bc967321e7b6f852e914d14bede324cd1accb7f81811929a6a57fea9 AS health-probe-builder
WORKDIR /go/src/app
RUN apk update && apk add --no-cache git
RUN git clone https://github.com/grpc-ecosystem/grpc-health-probe.git
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/Permify/permify

go 1.25.1
go 1.25.5

tool (
github.com/bufbuild/buf/cmd/buf
Expand Down
2 changes: 1 addition & 1 deletion go.work
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
go 1.25.1
go 1.25.5

use .
2 changes: 1 addition & 1 deletion sdk/go/grpc/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module main

go 1.25.1
go 1.25.5

require (
buf.build/gen/go/permifyco/permify/protocolbuffers/go v1.36.10-20251103093708-d86d36fe3266.1
Expand Down