Skip to content

chore(deps): Bump Go >= 1.24.12 to fix CVE-2025-61726#6276

Open
patelchaitany wants to merge 1 commit intofeast-dev:v0.54-branchfrom
patelchaitany:fix/CVE-2025-61726-v0.54
Open

chore(deps): Bump Go >= 1.24.12 to fix CVE-2025-61726#6276
patelchaitany wants to merge 1 commit intofeast-dev:v0.54-branchfrom
patelchaitany:fix/CVE-2025-61726-v0.54

Conversation

@patelchaitany
Copy link
Copy Markdown
Contributor

@patelchaitany patelchaitany commented Apr 14, 2026 •
edited by devin-ai-integration bot
Loading

Summary

  • Bump the Go toolchain from 1.22.9 to 1.24.12 in the feast-operator go.mod and Dockerfile to fix CVE-2025-61726 (memory exhaustion in net/url query parameter parsing, CVSS 7.5).
  • Upgraded Operator SDK to v1.41.0 and golangci-lint to v2.1.0.
  • Updated all CI workflow files to use Go 1.24.12.

Test plan

  • CI workflows pass with Go 1.24.12
  • Operator builds successfully with the updated Dockerfile
  • go mod tidy produces no changes on the updated go.mod/go.sum

Made with Cursor

Open with Devin

@patelchaitany patelchaitany requested a review from a team as a code owner April 14, 2026 08:03
devin-ai-integration[bot]
devin-ai-integration bot reviewed Apr 14, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

Open in Devin Review

@patelchaitany patelchaitany changed the title chore(deps): bump Go >= 1.24.12 to fix CVE-2025-61726 chore(deps): Bump Go >= 1.24.12 to fix CVE-2025-61726 Apr 14, 2026
@patelchaitany
chore(deps): bump Go >= 1.24.12 to fix CVE-2025-61726
4013812 
Bump the Go toolchain from 1.22.9 to 1.24.12 in the feast-operator
go.mod and Dockerfile to fix CVE-2025-61726 (memory exhaustion in
net/url query parameter parsing, CVSS 7.5).
Also upgraded Operator SDK to v1.41.0 and golangci-lint to v2.1.0.

Signed-off-by: Chaitany patel <patelchaitany93@gmail.com>
Made-with: Cursor
@patelchaitany patelchaitany force-pushed the fix/CVE-2025-61726-v0.54 branch from c11371a to 4013812 Compare April 14, 2026 11:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments

Assignees

No one assigned

Labels

do-not-merge/work-in-progress ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@patelchaitany @ntkathole