From 5cc553d1ca25e1c08c5a25da6a5e8d52613a87a8 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Thu, 4 Dec 2025 02:23:14 -0800 Subject: [PATCH] Upgrade Go to 1.24.11 to fix GO-2025-4155 vulnerability (#815) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepared by Claude Code, reviewd by me. ## Summary - Upgrade Go from 1.24.9 to 1.24.11 in the main `go.mod` to fix govulncheck CI failure - Upgrade Go from 1.24.7 to 1.24.11 in `deploy/go.mod` for the same vulnerability fix ## Details This PR addresses the failing `govulncheck` check in CI caused by vulnerability **GO-2025-4155**: - **Vulnerability**: Excessive resource consumption when printing error string for host certificate validation in `crypto/x509` - **Found in**: `crypto/x509@go1.24.9` (and earlier versions like go1.24.7) - **Fixed in**: `crypto/x509@go1.24.11` - **More info**: https://pkg.go.dev/vuln/GO-2025-4155 Both Go module files in the repository are updated to 1.24.11 to ensure consistent vulnerability remediation. ## Test plan - [x] CI passes govulncheck after the Go version upgrade 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude --- deploy/go.mod | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 5c968ef..0dc6224 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.24.7 +go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 diff --git a/go.mod b/go.mod index f578211..5fc58a0 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.24.9 +go 1.24.11 require ( cloud.google.com/go/kms v1.23.2