Update Go for security reasons
Similarly to the report #1440, I have Miller in a docker image which was run through Docker Scout. It pointed out a few CVEs in the Go stdlib, including two critical ones, supposedly fixed in go 1.24
* 10C -- CVE-2025-68121 -- Fix version: 1.24.13
* 9.1C -- CVE-2025-22871 -- Fix version: 1.23.8
* The list goes on with less Critical notifications.
I'll caveat this by admitting that I haven't looked at Go code before (or written any) and I am not sure if these specific CVEs or any of the other less urgent ones are at all relevant or potentially exploitable.
Is it worth attempting to update the version of Go used by Miller?
关闭于 2026-04-17 1 条评论