fix(deps): bump toolchain and vulnerable dependencies for patch release - #4996
fix(deps): bump toolchain and vulnerable dependencies for patch release#4996alleaditya wants to merge 3 commits into
Conversation
Bumps: - Go to 1.26.2 - golang.org/x/crypto to v0.52.0 - google.golang.org/grpc to v1.79.3
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go version from 1.26.1 to 1.26.2 across Dockerfiles, module definitions, and setup scripts, alongside upgrading several Go dependencies. It also refactors directory operations in the integration tests to simplify command execution. Feedback highlights that while Go version strings were updated in print statements within build.sh and run_e2e_tests.sh, the actual download URLs in those scripts still point to the old 1.26.1 version. Additionally, it is recommended to ensure consistency with any .go-version file in the repository.
| echo Installing git | ||
| sudo apt-get install git | ||
| echo Installing go-lang 1.26.1 | ||
| echo Installing go-lang 1.26.2 |
There was a problem hiding this comment.
The Go version in the wget URL on the next line (line 44) was not updated to 1.26.2. It still downloads 1.26.1:
wget -O go_tar.tar.gz https://go.dev/dl/go1.26.1.linux-amd64.tar.gz -qPlease update it to:
wget -O go_tar.tar.gz https://go.dev/dl/go1.26.2.linux-amd64.tar.gz -q| # e.g. architecture=arm64 or amd64 | ||
| architecture=$(dpkg --print-architecture) | ||
| echo "Installing go-lang 1.26.1..." | ||
| echo "Installing go-lang 1.26.2..." |
There was a problem hiding this comment.
The Go version in the wget URL on the next line (line 138) was not updated to 1.26.2. It still downloads 1.26.1:
wget -O go_tar.tar.gz https://go.dev/dl/go1.26.1.linux-${architecture}.tar.gz -qPlease update it to:
wget -O go_tar.tar.gz https://go.dev/dl/go1.26.2.linux-${architecture}.tar.gz -q| module github.com/googlecloudplatform/gcsfuse/v2 | ||
|
|
||
| go 1.26.1 | ||
| go 1.26.2 |
There was a problem hiding this comment.
When updating the Go version in go.mod, please ensure it is also updated consistently in the .go-version file (if present in the repository) to prevent build and CI pipelines from using an incorrect version.
References
- When updating the Go version, ensure it is updated consistently in both go.mod and the .go-version file to prevent build and CI pipelines from using an incorrect version.
1 participant
Description
Bumps following for patch release bug:
golang.org/x/cryptotov0.52.0google.golang.org/grpctov1.79.3Link to the issue in case of a bug fix.
b/543561636
Testing details
make buildandgo test ./...except for some parallel test flakiness ininternal/fs.