From 06a5c11c0915d38484990147b0134ed1f6a2ab56 Mon Sep 17 00:00:00 2001 From: Alano Terblanche <18033717+Benehiko@users.noreply.github.com> Date: Thu, 9 Jul 2026 16:10:10 +0200 Subject: [PATCH 1/2] fix(deps): bump Go 1.25.11 -> 1.25.12 for CVE-2026-39822, CVE-2026-42505 Go security release addresses: - CVE-2026-39822: os.Root escape via symlink plus trailing slash - CVE-2026-42505: crypto/tls Encrypted Client Hello privacy leak Updates the go directive in go.work and all module go.mod files (client, plugin, plugins/credentialhelper, plugins/pass, store, x). CI (go-version-file: go.work) and Docker builds (GO_VERSION from go.work via Makefile) pick this up automatically. Also bumps the stale standalone fallback default in store/docker-bake.hcl from 1.24 to 1.25.12. Co-Authored-By: Claude Opus 4.8 (1M context) --- client/go.mod | 2 +- go.work | 2 +- plugin/go.mod | 2 +- plugins/credentialhelper/go.mod | 2 +- plugins/pass/go.mod | 2 +- store/docker-bake.hcl | 2 +- store/go.mod | 2 +- x/go.mod | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/client/go.mod b/client/go.mod index cc1f33a6..ddbe64ee 100644 --- a/client/go.mod +++ b/client/go.mod @@ -1,6 +1,6 @@ module github.com/docker/secrets-engine/client -go 1.25.11 +go 1.25.12 // This `replace` is only for CI to function. // The correct version will get resolved from below when this module is diff --git a/go.work b/go.work index b356c01a..2f208818 100644 --- a/go.work +++ b/go.work @@ -1,4 +1,4 @@ -go 1.25.11 +go 1.25.12 use ( ./client diff --git a/plugin/go.mod b/plugin/go.mod index 3edb5bbf..88dce32b 100644 --- a/plugin/go.mod +++ b/plugin/go.mod @@ -1,6 +1,6 @@ module github.com/docker/secrets-engine/plugin -go 1.25.11 +go 1.25.12 // This `replace` is only for CI to function. // The correct version will get resolved from below when this module is diff --git a/plugins/credentialhelper/go.mod b/plugins/credentialhelper/go.mod index 1f1d05ba..4249de31 100644 --- a/plugins/credentialhelper/go.mod +++ b/plugins/credentialhelper/go.mod @@ -1,6 +1,6 @@ module github.com/docker/secrets-engine/plugins/credentialhelper -go 1.25.11 +go 1.25.12 // This `replace` is only for CI to function. // The correct version will get resolved from below when this module is diff --git a/plugins/pass/go.mod b/plugins/pass/go.mod index e57c1894..768edcf5 100644 --- a/plugins/pass/go.mod +++ b/plugins/pass/go.mod @@ -1,6 +1,6 @@ module github.com/docker/secrets-engine/plugins/pass -go 1.25.11 +go 1.25.12 replace github.com/docker/secrets-engine/client => ./../../client diff --git a/store/docker-bake.hcl b/store/docker-bake.hcl index 8888a3bc..ca409c27 100644 --- a/store/docker-bake.hcl +++ b/store/docker-bake.hcl @@ -24,7 +24,7 @@ group "default" { } variable "GO_VERSION" { - default = "1.24" + default = "1.25.12" } target "fedora_43_gnome_keyring" { diff --git a/store/go.mod b/store/go.mod index c0c3fcb8..35881308 100644 --- a/store/go.mod +++ b/store/go.mod @@ -1,6 +1,6 @@ module github.com/docker/secrets-engine/store -go 1.25.11 +go 1.25.12 // This `replace` is only for CI to function. // The correct version will get resolved from below when this module is diff --git a/x/go.mod b/x/go.mod index 7da4bba0..b4c56b8f 100644 --- a/x/go.mod +++ b/x/go.mod @@ -1,6 +1,6 @@ module github.com/docker/secrets-engine/x -go 1.25.11 +go 1.25.12 require ( connectrpc.com/connect v1.19.1 From f26124f60777fa52f9fb3f19c41f7dc4dfb17337 Mon Sep 17 00:00:00 2001 From: Alano Terblanche <18033717+Benehiko@users.noreply.github.com> Date: Thu, 9 Jul 2026 16:42:47 +0200 Subject: [PATCH 2/2] fix(deps): sync vendor/modules.txt for Go 1.25.12 bump go work vendor records each local module's go directive in vendor/modules.txt; regenerate so the Go Work Check CI gate (go work sync/vendor clean) passes. Co-Authored-By: Claude Opus 4.8 (1M context) --- vendor/modules.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/vendor/modules.txt b/vendor/modules.txt index d4907616..6724ed35 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -40,13 +40,13 @@ github.com/davecgh/go-spew/spew github.com/docker/docker-credential-helpers/client github.com/docker/docker-credential-helpers/credentials # github.com/docker/secrets-engine/client v0.0.29 => ./client -## explicit; go 1.25.11 +## explicit; go 1.25.12 # github.com/docker/secrets-engine/plugin v0.1.0 => ./plugin -## explicit; go 1.25.11 +## explicit; go 1.25.12 # github.com/docker/secrets-engine/store v0.2.0 => ./store -## explicit; go 1.25.11 +## explicit; go 1.25.12 # github.com/docker/secrets-engine/x v0.1.0-do.not.use => ./x -## explicit; go 1.25.11 +## explicit; go 1.25.12 # github.com/go-logr/logr v1.4.3 ## explicit; go 1.18 github.com/go-logr/logr