fix: upgrade Go dependencies to fix CRITICAL/HIGH CVEs (go 1.24 compat) by qiluo-msft · Pull Request #747 · sonic-net/sonic-gnmi

qiluo-msft · 2026-08-07T19:08:03Z

Why I did it

Trivy CVE scan identified CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-gnmi. This PR fixes 12 CVEs using versions compatible with Go 1.24 (no CodeQL workflow changes needed).

A follow-up PR (#746) addresses the remaining 11 HIGH CVEs that require go ≥ 1.25.

How I did it

Package	Old	New	CVEs Fixed
`google.golang.org/grpc`	v1.69.2	v1.80.0	CVE-2026-33186 (CRITICAL), GHSA-m425-mq94-257g
`golang.org/x/crypto`	v0.36.0	v0.48.0	CVE-2024-45337, CVE-2025-22869, CVE-2025-47913
`golang.org/x/net`	v0.38.0	v0.49.0	CVE-2023-39325, CVE-2023-45288, CVE-2024-45338
`golang.org/x/text`	v0.23.0	v0.34.0	CVE-2020-14040, CVE-2021-38561, CVE-2022-32149
`github.com/antchfx/xpath`	v1.1.10	v1.3.6	CVE-2026-32287
`github.com/antchfx/jsonquery`	v1.1.4	v1.3.7	(parent of vulnerable xpath)
`github.com/antchfx/xmlquery`	v1.3.1	v1.5.1	(parent of vulnerable xpath)

Replace directives aligned with go mod tidy selected versions (glog v1.2.5, x/sys v0.41.0, protobuf v1.36.11).

Makefile: Removed the obsolete x/crypto@v0.0.0-20191206172530 (Dec 2019) vendor override. This ancient version was incompatible with grpc v1.80.0+ and is no longer needed — x/crypto v0.48.0 retains ssh/terminal and RevokedCertificates backward compatibility.

How to verify it

trivy fs . --severity CRITICAL,HIGH

CRITICAL count should drop to 0; 11 remaining HIGH CVEs (requiring go ≥ 1.25) will be addressed in a follow-up PR.

Fixes 12 CVEs using maximum versions compatible with Go 1.24 (no CodeQL issues): - google.golang.org/grpc v1.69.2 -> v1.80.0 (CVE-2026-33186 CRITICAL, GHSA-m425-mq94-257g) - golang.org/x/crypto v0.36.0 -> v0.48.0 (CVE-2024-45337, CVE-2025-22869, CVE-2025-47913) - golang.org/x/net v0.38.0 -> v0.49.0 (CVE-2023-39325, CVE-2023-45288, CVE-2024-45338) - golang.org/x/text v0.23.0 -> v0.34.0 (CVE-2020-14040, CVE-2021-38561, CVE-2022-32149) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287) - antchfx/jsonquery v1.1.4 -> v1.3.7, antchfx/xmlquery v1.3.1 -> v1.5.1 Makefile: remove obsolete x/crypto@v0.0.0-20191206172530 vendor override. The 2019 crypto is no longer needed; x/crypto v0.48.0 retains ssh/terminal and RevokedCertificates backward compatibility. Remaining 11 HIGH CVEs requiring go >= 1.25 are tracked separately.

…24 compat)" This reverts commit 6f34697.

Fixes 12 CVEs using maximum versions compatible with Go 1.24 (no CodeQL issues): - google.golang.org/grpc v1.69.2 -> v1.80.0 (CVE-2026-33186 CRITICAL, GHSA-m425-mq94-257g) - golang.org/x/crypto v0.36.0 -> v0.48.0 (CVE-2024-45337, CVE-2025-22869, CVE-2025-47913) - golang.org/x/net v0.38.0 -> v0.49.0 (CVE-2023-39325, CVE-2023-45288, CVE-2024-45338) - golang.org/x/text v0.23.0 -> v0.34.0 (CVE-2020-14040, CVE-2021-38561, CVE-2022-32149) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287) - antchfx/jsonquery v1.1.4 -> v1.3.7, antchfx/xmlquery v1.3.1 -> v1.5.1 Makefile: remove obsolete x/crypto@v0.0.0-20191206172530 vendor override. The 2019 crypto is no longer needed; x/crypto v0.48.0 retains ssh/terminal and RevokedCertificates backward compatibility. Remaining 11 HIGH CVEs requiring go >= 1.25 are tracked separately. Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>

Pre-existing replace directives were pinning below the versions selected by go mod tidy after the grpc/x/* upgrades: - glog: replace v0.0.0-20160126 -> v1.2.5 (matches require) - x/sys: replace v0.26.0 -> v0.41.0 (matches require) - protobuf: replace v1.34.1 -> v1.36.11 (matches require) Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>

mssonicbld · 2026-08-07T19:08:11Z

/azp run

azure-pipelines · 2026-08-07T19:08:12Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

azure-pipelines · 2026-08-07T19:08:25Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Copilot

Pull request overview

This PR upgrades key Go module dependencies in sonic-gnmi to address CRITICAL/HIGH CVEs while staying compatible with a Go 1.24 toolchain, and removes an older Makefile-based vendoring override that forced an ancient x/crypto snapshot.

Changes:

Bumped security-sensitive dependencies (notably google.golang.org/grpc, golang.org/x/crypto, golang.org/x/net, golang.org/x/text) and refreshed related indirect deps via go mod tidy.
Removed the Makefile logic that temporarily replaced vendored golang.org/x/crypto with a 2019 revision during the gnmi client patch/build flow.
Updated replace directives to align the module graph with the intended (CVE-fixed) versions.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File	Description
Makefile	Removes the legacy `x/crypto` backup/restore + 2019 override during gnmi client patch/build.
go.mod	Upgrades direct/indirect dependencies (including gRPC and x/* modules) and adjusts replace directives to match the intended pinned versions.

+	github.com/golang/glog v1.2.5
+	github.com/golang/mock v1.7.0-rc.1
 	github.com/golang/protobuf v1.5.4


 	github.com/Azure/sonic-mgmt-common => ../sonic-mgmt-common
 	// Glog patch needs to be updated to remove this.
-	github.com/golang/glog => github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
+	github.com/golang/glog => github.com/golang/glog v1.2.5
 	github.com/openconfig/gnmi => github.com/openconfig/gnmi v0.0.0-20200617225440-d2b4e6a45802


+# download and apply patch for gnmi client
+# use the already-vendored crypto (no longer need the old 2019 override;
+# x/crypto v0.24.0+ retains ssh/terminal and RevokedCertificates backward compat)
 	chmod -R u+w vendor
 	patch -d vendor -p0 < patches/gnmi_cli.all.patch
 	patch -d vendor -p0 < patches/gnmi_set.patch


x/crypto v0.48.0 changed ssh/terminal from a standalone package to a stub that imports golang.org/x/term. The gnmi_cli.all.patch adds code importing golang.org/x/crypto/ssh/terminal, which now transitively requires x/term. Since go mod vendor only analyzes unpatched code, x/term was not included in vendor, causing the gnmi_cli build to fail. Adding it explicitly ensures it is present in vendor before patches are applied. Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>

mssonicbld · 2026-08-07T21:05:54Z

/azp run

azure-pipelines · 2026-08-07T21:06:06Z

Azure Pipelines: Successfully started running 1 pipeline(s).

x/crypto v0.48.0 moved ssh/terminal from a standalone package to a stub that imports golang.org/x/term. The gnmi_cli code uses ssh/terminal, but go mod vendor omits both packages because the unpatched codebase does not import them (gnmi_cli is copied to vendor manually after go mod vendor). After removing the old 2019 crypto vendor override, the gnmi_cli build failed because neither ssh/terminal nor x/term was in vendor. Locally verified: gnmi_cli builds successfully with this fix. Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>

mssonicbld · 2026-08-07T21:38:22Z

/azp run

azure-pipelines · 2026-08-07T21:38:33Z

Azure Pipelines: Successfully started running 1 pipeline(s).

sonic-mgmt-common's patches/apply.sh applies patches to antchfx packages. These patches (jsonquery.patch, xmlquery.patch, xpath.patch) add sonic-specific functionality and are written for: - antchfx/jsonquery v1.1.4 - antchfx/xmlquery v1.3.1 - antchfx/xpath v1.1.10 Upgrading to v1.3.7/v1.5.1/v1.3.6 caused 2-7 patch hunks to FAIL per package, breaking the sonic-gnmi deb build. CVE-2026-32287 (antchfx/xpath) cannot be fixed here without also updating the patches in sonic-mgmt-common. That work is tracked separately. Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>

mssonicbld · 2026-08-07T22:51:41Z

/azp run

azure-pipelines · 2026-08-07T22:51:52Z

Azure Pipelines: Successfully started running 1 pipeline(s).

qiluo-msft added 4 commits August 7, 2026 18:20

Revert "fix: upgrade Go dependencies to fix CRITICAL/HIGH CVEs (go 1.…

b4f9a85

…24 compat)" This reverts commit 6f34697.

Copilot AI lite review requested due to automatic review settings August 7, 2026 19:08

qiluo-msft mentioned this pull request Aug 7, 2026

fix: upgrade to go 1.25 versions for remaining 11 HIGH CVEs #748

Open

Copilot started reviewing on behalf of qiluo-msft August 7, 2026 19:08 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

qiluo-msft force-pushed the master branch from b4f9a85 to 891ea7e Compare August 7, 2026 23:07

Navigation Menu

fix: upgrade Go dependencies to fix CRITICAL/HIGH CVEs (go 1.24 compat) - #747

fix: upgrade Go dependencies to fix CRITICAL/HIGH CVEs (go 1.24 compat)#747
qiluo-msft wants to merge 7 commits into
masterfrom
fix/cve-pr1-dco

qiluo-msft commented Aug 7, 2026

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

qiluo-msft commented Aug 7, 2026

Why I did it

How I did it

How to verify it

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

mssonicbld commented Aug 7, 2026

Uh oh!

azure-pipelines Bot commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants